Version 1.7.1 to develop by nielsdrost7 · Pull Request #1463 · InvoicePlane/InvoicePlane

nielsdrost7 · 2026-02-16T13:01:10Z

Summary by CodeRabbit

Security
- SVG logo uploads now blocked for security reasons; use PNG, JPG, or GIF files instead
- Enhanced input validation for invoices and quotes
- Improved XSS protection across template rendering
Dependencies
- Updated PHP requirement to 8.2+
- Updated Composer and npm dependencies to latest stable versions
Documentation
- Added comprehensive development guidelines and coding standards reference

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…nvoicePlane into fix/niels-1-sales-by-year

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…mplate

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…rep/v164

…utton' into prep/v164

Updated workflow trigger to allow manual dispatch.

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…n permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Added a validate_template_name function to check if a template name is valid based on type and scope.

Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML.

accesslint

Found 3 issues across 2 rules.

Repeated issues:

application/helpers/invoice_helper.php Image element missing alt attribute. — lines 32, 55

coderabbitai · 2026-02-16T13:02:01Z

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

This pull request introduces InvoicePlane version 1.7.0 with PHP 8.2+ compatibility, comprehensive security hardening (XSS sanitization in templates, template validation, SVG logo blocking), new automated CI/CD workflows, enhanced logging and input validation, and dependency updates across PHP and Node.js packages.

Changes

Cohort / File(s)	Summary
Documentation & Guidelines `.github/copilot-instructions.md`, `.junie/PR-1441-security-dry-analysis.md`, `.junie/guidelines.md`, `CHANGELOG.md`, `README.md`, `application/language/english/custom_lang.php`	Added comprehensive guidance for security-first development, coding standards, PSR-12 compliance, and detailed security/DRY analysis. Updated custom language documentation to clarify relationship with ip_lang.php. Added version 1.7.0 release notes and SVG security notice.
GitHub Actions Workflows `.github/workflows/composer-update.yml`, `.github/workflows/yarn-update.yml`, `.github/workflows/crowdin-sync.yml`, `.github/workflows/release.yml`, `.github/workflows/setup.yml`, `.github/workflows/phpunit.yml`, `.github/workflows/phpstan.yml`, `.github/workflows/pint.yml`	New comprehensive CI/CD workflows for automated dependency updates (Composer and Yarn), production releases with versioning, Crowdin translation synchronization, setup validation with error handling, test execution, static analysis, and code style checking.
GitHub Workflow Configuration Changes `.github/workflows/test-frontend.yml`, `.github/workflows/test-php.yml`, `.github/workflows/docker*.yml`, `.github/workflows/docker-publish.yml`	Migrated workflows from automatic push/tag triggers to manual `workflow_dispatch` triggers; updated PHP version matrix from 8.1 to 8.2; added explicit permissions declarations.
GitHub Automation Scripts & Config `.github/scripts/generate-package-update-report.cjs`, `.github/workflows/README.md`, `.gitignore`	Added Node.js script for generating human-readable Yarn package update reports; comprehensive workflow documentation; new ignore rules for workflow artifacts.
Core Security & Input Sanitization `application/core/Admin_Controller.php`, `application/helpers/file_security_helper.php`	Introduced recursive XSS sanitization with bypass lists for specific fields; enhanced logging of XSS detection attempts with contextual metadata; added `sanitize_for_logging()` helper to prevent log injection attacks; renamed `extract_safe_basename` return key for consistency.
Template & PDF Validation `application/helpers/template_helper.php`, `application/helpers/pdf_helper.php`	New validation functions `validate_template_name()` and `validate_pdf_template()` to prevent Local File Inclusion attacks; enhanced template selection with fallback to safe defaults; updated `generate_invoice_pdf()` signature to accept `$is_guest` parameter.
XSS Output Escaping in Views `application/modules/invoices/views/`, `application/modules/quotes/views/`, `application/modules/guest/views/`, `application/modules/payments/views/`, `application/modules/dashboard/views/`, `application/modules/products/views/`, `application/modules/settings/views/`, `application/modules/tasks/views/`, `application/modules/email_templates/views/`, `application/modules/mailer/views/`, `application/modules/layout/views/`, `application/views/`	Systematically applied `htmlsc()` and `_htmlsc()` escaping to all dynamic content rendering (invoice numbers, client names, tax rates, unit names, custom fields) across 30+ view files to prevent XSS injection.
SVG Security Hardening `application/helpers/invoice_helper.php`, `application/modules/sessions/views/session_login.php`, `application/modules/settings/controllers/Settings.php`, `application/modules/settings/views/partial_settings*.php`, `application/language/english/ip_lang.php`	Added SVG file blocking for logo uploads and display; implemented `check_svg_logos()` method for scanning existing SVG logos; added security validation on upload; added new language strings for SVG security warnings and error messages.
Input Validation & Sanitization `application/modules/invoices/controllers/Ajax.php`, `application/modules/invoices/models/Mdl_invoices_recurring.php`, `application/modules/quotes/models/Mdl_quotes.php`, `application/modules/clients/Enums/ClientTitleEnum.php`, `application/libraries/MY_Form_validation.php`	Added regex validation for invoice and quote numbers to restrict allowed characters; sanitized sumex-related fields; refactored enum constant visibility; minor formatting improvements.
Controller Updates for Template Validation `application/modules/invoices/controllers/Invoices.php`, `application/modules/quotes/controllers/Quotes.php`, `application/modules/guest/controllers/Invoices.php`, `application/modules/guest/controllers/Quotes.php`, `application/modules/guest/controllers/View.php`	Updated PDF generation flows to load template helper and validate template names before usage; added security checks to prevent template path traversal.
Session & Authentication `application/modules/sessions/controllers/Sessions.php`	Enhanced bot detection with expanded signature list using `mb_strtolower()` and `str_contains()`; refactored referer validation using `str_starts_with()`; improved consistency in empty/null checks.
mPDF & PDF Template Updates `application/helpers/mpdf_helper.php`, `application/views/invoice_templates/pdf/InvoicePlane.php`, `application/views/quote_templates/pdf/InvoicePlane.php`	Added HTML footer initialization to prevent PHP 8.3+ undefined key errors; added escaping for user details in QR code sections; removed duplicate discount column rendering in quote template.
Public Web Templates `application/views/invoice_templates/public/InvoicePlane_Web.php`, `application/views/quote_templates/public/InvoicePlane_Web.php`	Comprehensive refactor of invoice and quote public web templates with HTML escaping throughout; restructured quote template layout for improved UX with two-column headers and consistent indentation; added proper table structures for items and summary sections.
Additional View & Helper Fixes `application/helpers/e-invoice_helper.php`, `application/helpers/mailer_helper.php`, `application/helpers/pager_helper.php`, `application/modules/clients/controllers/Clients.php`, `application/modules/clients/models/Mdl_clients.php`, `application/modules/clients/views/view.php`, `application/modules/email_templates/views/template-tags.php`, `application/modules/guests/controllers/Get.php`, `application/modules/guest/controllers/gateways/Stripe.php`, `application/modules/reports/`, `application/modules/upload/`, `application/modules/setup/`, `application/third_party/MX/*`	Formatting improvements, escaping of dynamic fields, refactored string checks using modern PHP functions (`str_starts_with()` replacing `strpos()`), whitespace normalization, and minor output sanitization across multiple modules.
Frontend & JavaScript `assets/core/js/jquery-ui.js`, `assets/core/js/scripts.js`	Enhanced jQuery UI selector resolution for string-based option handling; improved CSS selector escaping including backslash handling; added `encodeHtml()` and `sanitize_email_template_html()` JavaScript functions with HTML parsing and safe tag whitelisting for email template preview.
Dependency Management `composer.json`, `package.json`, `index.php`	Updated PHP dependencies: CodeIgniter to pocketarc/codeigniter (3.3), added setasign/fpdi, updated mPDF, Composer, and security packages; updated Node.js sass to ^1.97; updated system path reference in front controller.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant View as View/Form
    participant Admin as Admin_Controller
    participant Sanitizer as sanitize_array()
    participant Logger as Log Service
    participant Database as Database

    User->>View: Submit form with user input
    View->>Admin: filter_input($_POST)
    Admin->>Admin: Check bypass list
    Admin->>Sanitizer: sanitize_array($data, $bypass_keys)
    Sanitizer->>Sanitizer: Recursive traversal of nested arrays
    Sanitizer->>Sanitizer: Apply xss_clean & strip_tags
    Sanitizer->>Sanitizer: Track modifications in $xss_detected
    Sanitizer->>Admin: Return sanitized data & detection flag
    Admin->>Admin: Update $_POST with sanitized values
    alt XSS Detected
        Admin->>Admin: Compose context payload (timestamp, user_id, URI, IP, user_agent)
        Admin->>Logger: Log error with XSS attempt details
        Logger->>Logger: Record to error log
    else No XSS
        Admin->>Database: Proceed with normal flow
    end
    Database->>View: Return result
    View->>User: Render response

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related issues

Inconsistent Language Files in English #1249: Custom language file documentation clarification directly addresses confusion about custom_lang.php overriding ip_lang.php by adding explicit documentation explaining the extension relationship while maintaining the empty array structure.

Possibly related PRs

Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 #1433: Both PRs implement identical template validation logic (validate_template_name, validate_pdf_template) and update controllers to use these new validators for template-based PDF generation across invoices and quotes.
Fix stored XSS vulnerabilities in multiple views (19 total) #1455: Both PRs apply overlapping XSS output-escaping fixes across the same view templates (invoice templates, view_sumex, client views, email templates) to prevent HTML/JavaScript injection.
v164 to master #1386: Both PRs modify shared CI/CD infrastructure files (.github/workflows/*) and the same security helper files (file_security_helper.php) with related code-level changes.

Poem

🐰 A rabbit hops through code with glee,
SVGs blocked, XSS-free!
Templates validated, logs now clean,
The cleanest version we've ever seen!
With workflows humming and escaping bright,
InvoicePlane shines ever more secure and right! 🔒✨

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch tagged/v171

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nielsdrost7 and others added 30 commits August 21, 2025 17:21

Temporary Commit Fix Niels - 1 - SalesByYear report

d7e6a08

Fix Niels - 1 - SalesByYear

1766bbe

Temporary Commit Fix Niels - 3 - Guest Get File

d80ae52

Apply suggestions from code review

1dbdbc3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Suggestions after code-review

1212a2b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

using strpos as per suggestion in code-review

5924d8f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

suggestion after code-review

fd7ed1d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

suggestion after code-review

f5ee38e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Final fixes for the Get file problem refs #1324

1b5d7a7

suggestion after code-review

9c7acdb

Merge branch 'fix/niels-1-sales-by-year' of github.com:InvoicePlane/I…

1139748

…nvoicePlane into fix/niels-1-sales-by-year

cleanup after code-review

366b3b5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

cleanup after code-review

d86929a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Get file (guest) fix refs #1324

7094e50

1340: Wrong quote/invoice guest download attachment button default te…

9b5ef4c

…mplate

1348: More fixes for PDF footer

44a94c2

1322: Show open invoices on guest index

b27be93

1340: guest route sanitization

572e82a

1340: guest route sanitization

cd05e15

1340: guest route sanitization

18a116f

1340: guest route sanitization

33ce869

Update application/modules/guest/controllers/Get.php

921225a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update application/modules/reports/models/Mdl_reports.php

41227ea

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update application/modules/reports/models/Mdl_reports.php

9b90780

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'fix/niels-1-sales-by-year' into prep/v164

1b7465c

Merge branch 'fix/niels-3-guest-get-file' into prep/v164

b1953af

Merge branch 'fix/1340-guest-route-sanitization' into prep/v164

8024e2c

Merge branch 'fix/1348-downloading-pdf-gives-ugly-gray-screen' into p…

5cbf2b1

…rep/v164

Merge branch 'fix/1340-wrong-quoteinvoice-guest-download-attachment-b…

f985fce

…utton' into prep/v164

version 1.7.0: PHP 8.2+ compatibility

bed535f

nielsdrost7 and others added 20 commits January 19, 2026 13:56

Change trigger from pull_request to workflow_dispatch

2e1d94a

Updated workflow trigger to allow manual dispatch.

Change trigger for PHP testing workflow

205d56f

Update PHP version in GitHub Actions workflow

1dd2b24

Remove emojis from yarn-update workflow output

32ccea0

Potential fix for code scanning alert no. 11: Workflow does not conta…

7470969

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 12: Workflow does not conta…

f31e94e

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 13: Workflow does not conta…

3adf7a3

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 14: Workflow does not conta…

37bde3f

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 15: Workflow does not conta…

bb15960

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Apply suggestions from code review

c027d2f

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Update .github/workflows/README.md

19068cb

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Delete .github/workflows/quickstart.yml

1a4147a

Updated Composer and Yarn Packages

6f6f6f8

Implement template name validation function

f4b81a5

Added a validate_template_name function to check if a template name is valid based on type and scope.

Add HTML encoder for safe email template sanitization

61b57f0

Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML.

InvoicePlane deleted a comment from coderabbitai bot Feb 16, 2026

accesslint bot reviewed Feb 16, 2026

View reviewed changes

Comment thread .junie/guidelines.md

Comment thread application/helpers/invoice_helper.php

Comment thread application/helpers/invoice_helper.php

nielsdrost7 marked this pull request as ready for review February 16, 2026 13:01

nielsdrost7 merged commit 93622f2 into development Feb 16, 2026
7 checks passed

coderabbitai bot mentioned this pull request Mar 20, 2026

Render email template previews with sanitized HTML and harden build tooling #1486

Merged

This was referenced Apr 5, 2026

Fix Stored XSS Vulnerabilities with Comprehensive Application-Wide Protection #1500

Draft

Fix RCE vulnerability + additional security issues #1505

Draft

add application container #1509

Merged

Fix file path traversal vulnerabilities across codebase #1510

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Version 1.7.1 to develop#1463

Version 1.7.1 to develop#1463
nielsdrost7 merged 73 commits intodevelopmentfrom
tagged/v171

nielsdrost7 commented Feb 16, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

accesslint bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot commented Feb 16, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related issues

Possibly related PRs

Poem

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nielsdrost7 commented Feb 16, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

accesslint bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related issues

Possibly related PRs

Poem

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nielsdrost7 commented Feb 16, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Feb 16, 2026 •

edited

Loading