5 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	e92b08ef6a	fix(security): block ORDER BY SQL injection via orderByField (GHSA-cp8p) (#663) ... The orderByField/orderBy query params were passed straight into Eloquent's orderBy() in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing arbitrary SQL in the ORDER BY clause (boolean-based blind injection). Adds App\Support\SafeOrderBy::apply() which only accepts a plain, optionally table-qualified column identifier as the sort target (rejecting expressions, sub-selects, etc.) and clamps the direction to asc/desc. Routed all 10 model sort sinks through it. Table-qualified columns stay valid, so joined/aliased sorts (e.g. estimates by customers.name) are unaffected. Adds unit tests covering injection rejection, plain + aliased columns, and direction clamping.	2026-06-12 09:18:29 +02:00
Darko Gjorgjijoski	c9d623a0dd	Revert "Export system" ... This reverts commit a79c4ec5ee.	2026-06-11 08:36:05 +02:00
mchev	a79c4ec5ee	Export system	2026-06-04 17:20:00 +02:00
mchev	aa88dc340d	Closes #588	2026-04-01 21:30:32 +02:00
mchev	07757e747e	Addresses SSRF risk	2026-03-21 19:14:51 +01:00