Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details by Copilot · Pull Request #1436 · InvoicePlane/InvoicePlane

Copilot · 2026-02-03T15:47:51Z

Addresses review feedback requesting complete release notes for the 1.7.0 PHP 8.2+ compatibility release with all GitHub issue numbers and field sanitization documentation.

Complete Release Notes for Version 1.7.0

Issues Fixed

Security Fixes:

Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 #1433 - Local File Inclusion (LFI) vulnerabilities in PDF template handling (Post-v1.7.0 tag)
Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1388, Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1387 - Unsafe jQuery plugin vulnerabilities (Code scanning alerts)
Security: Fix file access vulnerabilities across all controllers with reusable helper #1383 - File access vulnerabilities across all controllers
Code scanning alerts: Customize quote / invoice groups #5, Forbid invoice deletion / changes after printing #6, Adjust the alert box margins #7, Redmine integration #9, Export of invoices to different formats #10, Add subject line to email templates #11, Year or From-To date filter in Dashboard Overviews #12, Adding VAT ID and Tax/Fiscal Code as customer and user/company fields #13, SQL errors while adding custom fields #14, Cant find setup #15 (workflow permissions and security issues)

Bug Fixes and Improvements:

Potential fix for code scanning alert no. 5: Workflow does not contain permissions #1389 - Workflow permissions in GitHub Actions
Add version checking, logging, and log sanitization for client_einvoicing fields to handle unmigrated databases #1381 - E-invoicing field migration and version checking
Bump qs from 6.14.0 to 6.14.1 #1380 - Dependency update (qs package bump from 6.14.0 to 6.14.1)
[IP-1376]: Reduce QR code image width to 100px #1377 - QR code image width reduced to 100px
Fix email address verification to allow both comma and semicolon separators #1375 - Email address verification now supports comma and semicolon separators
fix: remove libs that are deprecated #1373 - Removed deprecated library dependencies
[Projects] Improve formatting of default rate #1367, prevent the format_number returning other than numbers #1368 - Various bug fixes

Fields Sanitized for XSS Protection

The following fields have been sanitized and properly escaped to prevent XSS attacks:

invoice_number - Escaped in all templates and views
quote_number - Escaped in all templates and views
tax_rate_name - Sanitized on input, escaped on output
payment_method_name - Sanitized on input, escaped on output
custom_field_label - Protected in all custom field displays
Client address fields - Sanitized for safe display
sumex_observations - Sanitized on input
quote_password - Sanitized on input
quote_notes - Sanitized on input
Email template content - Proper HTML escaping applied
File names in upload operations - Sanitized before logging (prevents log poisoning)

Differences Between v1.7.0 Tag and This Branch

Post-v1.7.0 Additions (This Branch)

Security Fix - PR #1433 (commit 0f5b9ff)

Fixed Local File Inclusion (LFI) vulnerabilities in PDF generation
Added template validation for invoice_template and quote_template URL parameters
Improved security logging for template operations
Prevented directory traversal attacks through template selection

Documentation Improvements (commits 2e4cff7, 4d6b4ef, 9bdbd5c, 4e2496e)

Added "What's New in Version 1.7.0" section to README
Created CHANGELOG.md with detailed release notes
Added complete list of all GitHub issues addressed with numbers
Documented all fields sanitized for XSS protection
Added upgrade guidance for 1.6.x users
Removed decorative emoticons per maintainer feedback

What Was Already in v1.7.0 (from v1.6.4)

Core PHP 8.2+ compatibility (commit bed535f)
XSS vulnerability fixes across templates and user inputs
Log poisoning vulnerability fix in file upload handling
SVG logo blocking for security
Multiple code scanning alert fixes
Workflow permission improvements

Changes Made

Added "What's New in Version 1.7.0" section to README
- PHP 8.2+ compatibility highlighted as primary feature
- Complete list of all issues fixed with GitHub issue numbers
- Detailed breakdown of fields sanitized for XSS protection
- Security fixes (XSS, LFI, log poisoning) documented with appropriate detail
- SVG logo blocking explained with upgrade path
- 5-step upgrade guide for 1.6.x users
- Professional formatting without emoticons
Created comprehensive CHANGELOG.md following Keep a Changelog format
- Complete 1.7.0 release notes categorized by type (Added, Changed, Security, Fixed Issues, Removed)
- All GitHub issue numbers explicitly listed (Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 #1433, Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1388, Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1387, Potential fix for code scanning alert no. 5: Workflow does not contain permissions #1389, Security: Fix file access vulnerabilities across all controllers with reusable helper #1383, Add version checking, logging, and log sanitization for client_einvoicing fields to handle unmigrated databases #1381, Bump qs from 6.14.0 to 6.14.1 #1380, [IP-1376]: Reduce QR code image width to 100px #1377, Fix email address verification to allow both comma and semicolon separators #1375, fix: remove libs that are deprecated #1373, [Projects] Improve formatting of default rate #1367, prevent the format_number returning other than numbers #1368)
- All code scanning alerts documented (Customize quote / invoice groups #5, Forbid invoice deletion / changes after printing #6, Adjust the alert box margins #7, Redmine integration #9, Export of invoices to different formats #10, Add subject line to email templates #11, Year or From-To date filter in Dashboard Overviews #12, Adding VAT ID and Tax/Fiscal Code as customer and user/company fields #13, SQL errors while adding custom fields #14, Cant find setup #15)
- Detailed field sanitization documentation with specific field names
- Technical detail on security vulnerabilities for maintainers
- Security disclosure policy included
Cross-linked documentation
- README links to CHANGELOG for full details
- Consistent messaging across both files

Structure

The README now flows: badges → version highlights → issues fixed → fields sanitized → upgrade steps → existing content (features, installation, community).

Information density optimized for users deciding whether to upgrade and how to do so safely, with complete transparency about all issues addressed and security improvements made.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Summary by CodeRabbit

Documentation
- Added comprehensive CHANGELOG documenting project changes and security advisories for version 1.7.0
- Updated README with version 1.7.0 release details, including PHP 8.2+ compatibility requirements, security enhancements, and upgrade guidance

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

nielsdrost7

@copilot I actually meant the exact changelog for this release. Which issues have been addressed.

Show me in the main comment of this pull-request, at the top of this PR.
What are the differences between tag v1.7.0 and this branch
Which improvements have been made

coderabbitai · 2026-02-03T15:55:50Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot · 2026-02-03T15:57:02Z

@copilot I actually meant the exact changelog for this release. Which issues have been addressed.

Show me in the main comment of this pull-request, at the top of this PR.
...

Differences between v1.7.0 and this branch

Commits added after v1.7.0 tag:

1. Security Fix - PR #1433 (commit 0f5b9ff)

Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0
Added template validation to prevent LFI vulnerability in PDF generation
Validated invoice_template and quote_template URL parameters
Improved security logging for template operations
Prevented directory traversal attacks through template selection

2. Documentation improvements (commits 2e4cff7, 4d6b4ef)

Added "What's New in Version 1.7.0" section to README
Created CHANGELOG.md with detailed release notes
Added upgrade guidance for 1.6.x users
Documented PHP 8.2+ compatibility and security improvements

Issues addressed in this branch (post-v1.7.0):

Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 #1433 - Local File Inclusion (LFI) vulnerabilities in PDF template handling

What was already in v1.7.0 (from v1.6.4):

Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1388, Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1387 - Unsafe jQuery plugin vulnerabilities
Potential fix for code scanning alert no. 5: Workflow does not contain permissions #1389, Security: Fix file access vulnerabilities across all controllers with reusable helper #1383 - File access and workflow permission security fixes
Add version checking, logging, and log sanitization for client_einvoicing fields to handle unmigrated databases #1381 - E-invoicing field migration handling
Bump qs from 6.14.0 to 6.14.1 #1380 - Dependency update (qs package)
[IP-1376]: Reduce QR code image width to 100px #1377 - QR code display improvement
Fix email address verification to allow both comma and semicolon separators #1375 - Email separator handling
fix: remove libs that are deprecated #1373 - Deprecated library removal
[Projects] Improve formatting of default rate #1367, prevent the format_number returning other than numbers #1368 - Various bug fixes
Core PHP 8.2+ compatibility (commit bed535f)

The v1.7.0 tag was the initial release. This branch adds critical post-release security fixes (#1433) plus comprehensive documentation.

coderabbitai

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@README.md`:
- Around line 28-32: Update the PHP compatibility wording to be consistent:
either change the heading text "PHP 8.2+ compatibility" (near "InvoicePlane
1.7.0") to "PHP 8.1+ compatibility" if you intend to support 8.1–8.3+, or remove
"8.1" from the bullet "- * PHP 8.2+ Compatibility:** Full support for modern PHP
versions (8.1, 8.2, 8.3+)" so the list matches "8.2+"; modify the README.md
lines that contain the heading and the bullet to keep both the header and the
parenthetical list synchronized.
- Around line 32-38: The README has malformed Markdown bold/emphasis markers
(extra spaces inside "** ... **" and a stray leading "*" before the PHP line)
causing MD037 lint errors and broken rendering; fix by removing the stray "*"
and normalizing the bold markers to the correct form (e.g., change "- * PHP 8.2+
Compatibility:** Full support..." to a single list bullet and use "**PHP 8.2+
Compatibility:** Full support..." and similarly remove inner spaces in other
occurrences such as the section around "Enhanced Security" and the repeated
instance mentioned at line 52 so all bold/italic tokens are in the form
"**Text**" or "*Text*" with no leading/trailing spaces inside the asterisks.

nielsdrost7

@copilot show the full and complete release notes in the main content of this pull request.

Which exact github issues have been addressed by this release.
Show the issue numbers.
Show the notes about fields being sanitized.
Stop adding those fucking emoticons

…details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot · 2026-02-03T16:03:30Z

@copilot show the full and complete release notes in the main content of this pull request.

Which exact github issues have been addressed by this release.

Show the issue numbers.
...

Updated in commit 4e2496e. The README and CHANGELOG now include:

Issue numbers addressed:

Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 #1433 (LFI), Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1388/Potential fix for code scanning alert no. 8: Unsafe jQuery plugin #1387 (jQuery), Potential fix for code scanning alert no. 5: Workflow does not contain permissions #1389 (Workflow), Security: Fix file access vulnerabilities across all controllers with reusable helper #1383 (File access), Add version checking, logging, and log sanitization for client_einvoicing fields to handle unmigrated databases #1381 (E-invoicing), Bump qs from 6.14.0 to 6.14.1 #1380 (qs bump), [IP-1376]: Reduce QR code image width to 100px #1377 (QR code), Fix email address verification to allow both comma and semicolon separators #1375 (Email separators), fix: remove libs that are deprecated #1373 (Deprecated libs), [Projects] Improve formatting of default rate #1367/prevent the format_number returning other than numbers #1368 (Bug fixes)
Code scanning alerts: Customize quote / invoice groups #5, Forbid invoice deletion / changes after printing #6, Adjust the alert box margins #7, Redmine integration #9, Export of invoices to different formats #10, Add subject line to email templates #11, Year or From-To date filter in Dashboard Overviews #12, Adding VAT ID and Tax/Fiscal Code as customer and user/company fields #13, SQL errors while adding custom fields #14, Cant find setup #15

Fields sanitized for XSS:

invoice_number, quote_number, tax_rate_name, payment_method_name, custom_field_label, client addresses, sumex_observations, quote_password, quote_notes, email template content, file names in upload logging

All emoticons removed from documentation.

* Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * to older version for 1.6.5 purposes * to older version for 1.6.5 purposes * [WIP] Fix path traversal vulnerability in get_file method (#1459) * Initial plan * Fix incomplete validate_template_name function in template_helper.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve log injection prevention in validate_template_name Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Potential fix for code scanning alert no. 18: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * Implement template name validation function Added a validate_template_name function to check if a template name is valid based on type and scope. * Add HTML encoder for safe email template sanitization Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

Initial plan

2e4cff7

Copilot AI assigned Copilot and nielsdrost7 Feb 3, 2026

Copilot AI mentioned this pull request Feb 3, 2026

Version 1.7.0 into develop branch: PHP 8.2+ compatibility #1366

Closed

Copilot started work on behalf of nielsdrost7 February 3, 2026 15:48 View session

Add comprehensive version 1.7.0 documentation to README and CHANGELOG

4d6b4ef

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update README for Version 1.7.0 PHP 8.2 compatibility~~ Add version 1.7.0 release documentation with upgrade guidance and security highlights Feb 3, 2026

Copilot AI requested a review from nielsdrost7 February 3, 2026 15:51

Copilot finished work on behalf of nielsdrost7 February 3, 2026 15:51

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 15:54 View session

Fix formatting and update version 1.7.0 details

9bdbd5c

Copilot AI requested a review from nielsdrost7 February 3, 2026 15:58

Copilot finished work on behalf of nielsdrost7 February 3, 2026 15:58

coderabbitai bot reviewed Feb 3, 2026

View reviewed changes

Comment thread README.md Outdated

Comment thread README.md Outdated

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 15:59 View session

Add complete release notes with issue numbers and field sanitization …

4e2496e

…details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot AI changed the title ~~Add version 1.7.0 release documentation with upgrade guidance and security highlights~~ Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details Feb 3, 2026

Copilot AI requested a review from nielsdrost7 February 3, 2026 16:04

Copilot finished work on behalf of nielsdrost7 February 3, 2026 16:04

nielsdrost7 marked this pull request as ready for review February 3, 2026 19:20

nielsdrost7 merged commit 55c17af into prep/v170 Feb 3, 2026

nielsdrost7 deleted the copilot/sub-pr-1366 branch February 3, 2026 19:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details#1436

Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details#1436
nielsdrost7 merged 4 commits intoprep/v170from
copilot/sub-pr-1366

Copilot AI commented Feb 3, 2026 •

edited

Loading

Uh oh!

nielsdrost7 left a comment

Uh oh!

coderabbitai bot commented Feb 3, 2026 •

edited

Loading

Review skipped

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

nielsdrost7 left a comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Complete Release Notes for Version 1.7.0

Issues Fixed

Fields Sanitized for XSS Protection

Differences Between v1.7.0 Tag and This Branch

Post-v1.7.0 Additions (This Branch)

What Was Already in v1.7.0 (from v1.6.4)

Changes Made

Structure

Summary by CodeRabbit

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Copilot AI commented Feb 3, 2026

Differences between v1.7.0 and this branch

Commits added after v1.7.0 tag:

Issues addressed in this branch (post-v1.7.0):

What was already in v1.7.0 (from v1.6.4):

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 3, 2026 •

edited

Loading

coderabbitai bot commented Feb 3, 2026 •

edited

Loading