README.md (1)

28-33: Align the minimum PHP version across the release notes and upgrade steps.

Line 28 says “PHP 8.2+ compatibility,” but Line 32 lists 8.1 support and Line 76 asks for PHP 8.1+. This is contradictory. Pick a single minimum (8.1 or 8.2) and update all three places to match.

Also applies to: 75-77

.github/workflows/test-frontend.yml (1)

16-16: Consider updating Node.js test matrix (out of scope for this PR).

Node 14 and 16 have reached end-of-life. While not part of this PR's changes, consider updating the matrix to currently supported LTS versions (18, 20, 22) in a follow-up PR to ensure testing against actively maintained runtimes.

application/modules/mailer/views/invoice.php (1)

79-79: Consider escaping email field values for consistency.

While the PR correctly escapes invoice_number, other fields like client_email (line 79), user_email (line 110), and pdf_template (lines 136, 138) remain unescaped. Although email fields typically undergo format validation and pdf_template may be server-controlled, applying consistent escaping (using htmlsc()) to all dynamic output would strengthen the security posture uniformly.

application/modules/email_templates/views/form.php (1)

97-99: Consider escaping template names for consistency.

Template names ($template) are output without HTML escaping in both the value attribute (line 97) and display text (line 99). While these values likely come from validated filesystem sources, escaping would align with the broader XSS hardening effort in this PR and provide defense-in-depth.

The same applies to quote templates at lines 110-112.

♻️ Suggested fix

-                            <option class="hidden-invoice" value="<?php echo $template; ?>"
+                            <option class="hidden-invoice" value="<?php echo htmlsc($template); ?>"
                                 <?php check_select($selected_pdf_template, $template); ?>>
-                                <?php echo $template; ?>
+                                <?php echo htmlsc($template); ?>
                             </option>

Apply similarly to the quote templates section (lines 110-112).

.github/scripts/generate-package-update-report.cjs (1)

160-161: Consider guarding CLI execution to prevent side effects if imported as a module in the future

The script contains multiple process.exit() calls (lines 78, 153, 156) that would execute immediately if this file were ever required as a module. While the script is not currently imported anywhere, adding a guard is a defensive programming practice that prevents accidental side effects from future changes.

Optional guard

-// Run the script
-generateReport();
+// Run the script
+if (require.main === module) {
+  generateReport();
+}

application/modules/payments/views/form.php (1)

55-57: Consider escaping invoice_number for consistency with the XSS sanitization scope.

The PR objectives list invoice_number as a field to be sanitized for XSS protection. However, $invoice->invoice_number (line 57) and $payment->invoice_number (line 64) are output without htmlsc(). While invoice numbers may typically be numeric or alphanumeric, applying consistent escaping aligns with the defense-in-depth approach taken elsewhere in this PR.

♻️ Proposed fix

-                            <?php echo $invoice->invoice_number . ' - ' . htmlsc(format_client($invoice)) . ' - ' . format_currency($invoice->invoice_balance); ?>
+                            <?php echo htmlsc($invoice->invoice_number) . ' - ' . htmlsc(format_client($invoice)) . ' - ' . format_currency($invoice->invoice_balance); ?>

-                        <?php echo $payment->invoice_number . ' - ' . htmlsc(format_client($payment)) . ' - ' . format_currency($payment->invoice_balance); ?>
+                        <?php echo htmlsc($payment->invoice_number) . ' - ' . htmlsc(format_client($payment)) . ' - ' . format_currency($payment->invoice_balance); ?>

Also applies to: 63-64

application/modules/mailer/views/invoice.php (2)

78-80: Consider sanitizing email fields for consistency.

While email addresses are typically validated, echoing $invoice->client_email (line 79) and $invoice->user_email (line 110) directly without htmlsc() is inconsistent with the XSS hardening applied elsewhere in this PR. For defense-in-depth, consider wrapping these outputs as well.

-                           value="<?php echo $invoice->client_email; ?>">
+                           value="<?php echo htmlsc($invoice->client_email); ?>">

---

136-139: Consider sanitizing PDF template names for consistency.

The $pdf_template variable is echoed without escaping. While these values originate from server-side template file listings, sanitizing them maintains consistency with the XSS hardening approach in this PR.

-                        <option value="<?php echo $pdf_template; ?>"
+                        <option value="<?php echo htmlsc($pdf_template); ?>"
                             <?php check_select($selected_pdf_template, $pdf_template); ?>>
-                            <?php echo $pdf_template; ?>
+                            <?php echo htmlsc($pdf_template); ?>
                         </option>

application/modules/invoices/controllers/Ajax.php (1)

119-132: Consider using a literal space instead of \s in the regex for better precision.

The \s metacharacter matches any whitespace including tabs, newlines, and carriage returns—not just literal spaces. While the restrictive character set provides solid XSS protection, allowing tabs and newlines in invoice numbers could cause unexpected behavior if the field is processed by PDF libraries or other systems that don't handle these characters well.

The contains_invalid_characters translation key is present in the language files, so no issue there.

♻️ Suggested refinement to restrict whitespace to literal space only

-            if ( ! preg_match('/^[a-zA-Z0-9\-_\/\.\s]+$/', $invoice_number)) {
+            if ( ! preg_match('/^[a-zA-Z0-9\-_\/\. ]+$/', $invoice_number)) {

README.md (1)

200-203: Tighten wording: “PNG Image” → “PNG”.
Minor redundancy in the step text.

✏️ Suggested edit

- - Go to File → Export PNG Image
+ - Go to File → Export PNG

application/modules/tasks/views/form.php (1)

143-143: Inconsistent escaping: use htmlsc() instead of htmlspecialchars() with ENT_COMPAT.

Line 143 uses htmlspecialchars($project->project_name, ENT_COMPAT) which only escapes double quotes. The htmlsc() helper used elsewhere in this PR uses ENT_QUOTES which escapes both single and double quotes, providing stronger XSS protection. Consider using the consistent pattern for uniformity and defense-in-depth.

Proposed fix

-                                    <?php echo htmlspecialchars($project->project_name, ENT_COMPAT); ?>
+                                    <?php echo htmlsc($project->project_name); ?>

application/views/quote_templates/pdf/InvoicePlane.php (1)

166-166: Minor: Redundant escaping inside format_currency().

At lines 166 and 178, htmlsc() is applied to item_price and item_total before passing to format_currency(). Since format_currency() expects numeric values and returns formatted numeric strings, the escaping here is redundant and could be removed for consistency with other format_currency() calls in this file (e.g., lines 172, 217, 228, 243).

♻️ Optional cleanup

                <td class="text-right">
-                    <?php echo format_currency(htmlsc($item->item_price)); ?>
+                    <?php echo format_currency($item->item_price); ?>
                </td>

                <td class="text-right">
-                    <?php echo format_currency(htmlsc($item->item_total)); ?>
+                    <?php echo format_currency($item->item_total); ?>
                </td>

Also applies to: 178-178

application/modules/settings/controllers/Settings.php (1)

218-227: Consider adding path traversal protection in remove_logo().

The $type parameter is used directly to construct a file path. While currently only called with known values ('invoice', 'login'), a malicious $type value could potentially access unintended files if this method becomes accessible with user input.

🛡️ Proposed fix to add validation

 public function remove_logo(string $type)
 {
+    // Validate type to prevent path traversal
+    if (!in_array($type, ['invoice', 'login'], true)) {
+        show_404();
+    }
+    
     unlink('./uploads/' . get_setting($type . '_logo'));

     $this->mdl_settings->save($type . '_logo', '');