Files
InvoiceShelf/app/Models/TaxType.php
Darko Gjorgjijoski ca6dd57bf9 fix(security): block ORDER BY SQL injection via orderByField (GHSA-cp8p) (#670)
v3 port. orderByField/orderBy were passed straight into Eloquent's orderBy()
in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing
arbitrary SQL in the ORDER BY clause.

Adds App\Support\SafeOrderBy::apply() (plain/table-qualified column identifier
only, asc/desc clamp) and routes all 10 model sort sinks through it. Aliased
sorts (e.g. estimates by customers.name) stay valid.

Adds unit tests for injection rejection, plain + aliased columns, direction clamp.
2026-06-12 11:02:15 +02:00

100 lines
2.6 KiB
PHP

<?php
namespace App\Models;
use App\Support\SafeOrderBy;
use Illuminate\Contracts\Pagination\LengthAwarePaginator;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Collection;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Database\Eloquent\Relations\HasMany;
class TaxType extends Model
{
use HasFactory;
protected $guarded = [
'id',
];
protected function casts(): array
{
return [
'percent' => 'float',
'fixed_amount' => 'integer',
'compound_tax' => 'boolean',
];
}
public const TYPE_GENERAL = 'GENERAL';
public const TYPE_MODULE = 'MODULE';
public function taxes(): HasMany
{
return $this->hasMany(Tax::class);
}
public function company(): BelongsTo
{
return $this->belongsTo(Company::class);
}
public function scopeWhereCompany(Builder $query): void
{
$query->where('company_id', request()->header('company'));
}
public function scopeWhereTaxType(Builder $query, int $tax_type_id): void
{
$query->orWhere('id', $tax_type_id);
}
public function scopeApplyFilters(Builder $query, array $filters): void
{
$filters = collect($filters);
if ($filters->get('tax_type_id')) {
$query->whereTaxType($filters->get('tax_type_id'));
}
if ($filters->get('company_id')) {
$query->whereCompany($filters->get('company_id'));
}
if ($filters->get('search')) {
$query->whereSearch($filters->get('search'));
}
if ($filters->get('orderByField') || $filters->get('orderBy')) {
$field = $filters->get('orderByField') ? $filters->get('orderByField') : 'payment_number';
$orderBy = $filters->get('orderBy') ? $filters->get('orderBy') : 'asc';
$query->whereOrder($field, $orderBy);
}
}
public function scopeWhereOrder(Builder $query, string $orderByField, string $orderBy): void
{
SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereSearch(Builder $query, string $search): void
{
$query->where('name', 'LIKE', '%'.$search.'%');
}
/**
* @return Collection|LengthAwarePaginator
*/
public function scopePaginateData(Builder $query, string $limit)
{
if ($limit == 'all') {
return $query->get();
}
return $query->paginate($limit);
}
}