Files
InvoiceShelf/app/Models/Item.php
Darko Gjorgjijoski ca6dd57bf9 fix(security): block ORDER BY SQL injection via orderByField (GHSA-cp8p) (#670)
v3 port. orderByField/orderBy were passed straight into Eloquent's orderBy()
in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing
arbitrary SQL in the ORDER BY clause.

Adds App\Support\SafeOrderBy::apply() (plain/table-qualified column identifier
only, asc/desc clamp) and routes all 10 model sort sinks through it. Aliased
sorts (e.g. estimates by customers.name) stay valid.

Adds unit tests for injection rejection, plain + aliased columns, direction clamp.
2026-06-12 11:02:15 +02:00

148 lines
3.8 KiB
PHP

<?php
namespace App\Models;
use App\Support\SafeOrderBy;
use Carbon\Carbon;
use Illuminate\Contracts\Pagination\LengthAwarePaginator;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Database\Eloquent\Collection;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Database\Eloquent\Relations\HasMany;
class Item extends Model
{
use HasFactory;
protected $guarded = ['id'];
protected $appends = [
'formattedCreatedAt',
];
protected function casts(): array
{
return [
'price' => 'integer',
];
}
public function unit(): BelongsTo
{
return $this->belongsTo(Unit::class, 'unit_id');
}
public function company(): BelongsTo
{
return $this->belongsTo(Company::class);
}
public function creator(): BelongsTo
{
return $this->belongsTo(User::class, 'creator_id');
}
public function currency(): BelongsTo
{
return $this->belongsTo(Currency::class);
}
public function scopeWhereSearch(Builder $query, string $search): Builder
{
return $query->where('items.name', 'LIKE', '%'.$search.'%');
}
public function scopeWherePrice(Builder $query, int $price): Builder
{
return $query->where('items.price', $price);
}
public function scopeWhereUnit(Builder $query, int $unit_id): Builder
{
return $query->where('items.unit_id', $unit_id);
}
public function scopeWhereOrder(Builder $query, string $orderByField, string $orderBy): void
{
SafeOrderBy::apply($query, $orderByField, $orderBy);
}
public function scopeWhereItem(Builder $query, int $item_id): void
{
$query->orWhere('id', $item_id);
}
/**
* Apply multiple filter conditions including search, price, unit, item, and ordering.
*/
public function scopeApplyFilters(Builder $query, array $filters): void
{
$filters = collect($filters);
if ($filters->get('search')) {
$query->whereSearch($filters->get('search'));
}
if ($filters->get('price')) {
$query->wherePrice($filters->get('price'));
}
if ($filters->get('unit_id')) {
$query->whereUnit($filters->get('unit_id'));
}
if ($filters->get('item_id')) {
$query->whereItem($filters->get('item_id'));
}
if ($filters->get('orderByField') || $filters->get('orderBy')) {
$field = $filters->get('orderByField') ? $filters->get('orderByField') : 'name';
$orderBy = $filters->get('orderBy') ? $filters->get('orderBy') : 'asc';
$query->whereOrder($field, $orderBy);
}
}
/**
* @return LengthAwarePaginator|Collection
*/
public function scopePaginateData(Builder $query, string $limit)
{
if ($limit == 'all') {
return $query->get();
}
return $query->paginate($limit);
}
public function getFormattedCreatedAtAttribute(mixed $value): string
{
$dateFormat = CompanySetting::getSetting('carbon_date_format', request()->header('company'));
return Carbon::parse($this->created_at)->translatedFormat($dateFormat);
}
public function taxes(): HasMany
{
return $this->hasMany(Tax::class)
->where('invoice_item_id', null)
->where('estimate_item_id', null);
}
public function scopeWhereCompany(Builder $query): void
{
$query->where('items.company_id', request()->header('company'));
}
public function invoiceItems(): HasMany
{
return $this->hasMany(InvoiceItem::class);
}
public function estimateItems(): HasMany
{
return $this->hasMany(EstimateItem::class);
}
}