mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-16 22:05:20 +00:00
e92b08ef6a
The orderByField/orderBy query params were passed straight into Eloquent's orderBy() in every model's scopeWhereOrder (and Invoice::scopeApplyFilters), allowing arbitrary SQL in the ORDER BY clause (boolean-based blind injection). Adds App\Support\SafeOrderBy::apply() which only accepts a plain, optionally table-qualified column identifier as the sort target (rejecting expressions, sub-selects, etc.) and clamps the direction to asc/desc. Routed all 10 model sort sinks through it. Table-qualified columns stay valid, so joined/aliased sorts (e.g. estimates by customers.name) are unaffected. Adds unit tests covering injection rejection, plain + aliased columns, and direction clamping.