Files
InvoiceShelf/app/Http/Requests/RecurringInvoiceRequest.php
Darko Gjorgjijoski 84524ce247 fix(security): recompute document totals server-side (GHSA-8c69) (#672)
v3 port. Invoice/estimate/recurring creation and update accepted total,
sub_total, tax and due_amount straight from the request with no recalculation,
letting a client persist financial totals that don't match the line items
(and corrupt the invoice update due-amount/paid-amount logic which keyed off
the client total).

- Adds App\Support\DocumentTotals (mirrors the front-end calc) trusting only
  price/quantity/discounts/tax-line amounts.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals; the shared DocumentItemService::createItems recomputes each
  item total; InvoiceService::update keys its due-amount logic off the
  recomputed total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored; existing create/update tests no longer assert the now
server-authoritative derived totals.
2026-06-12 11:02:23 +02:00

144 lines
4.3 KiB
PHP

<?php
namespace App\Http\Requests;
use App\Models\CompanySetting;
use App\Models\Customer;
use App\Models\RecurringInvoice;
use App\Support\DocumentTotals;
use Illuminate\Foundation\Http\FormRequest;
class RecurringInvoiceRequest extends FormRequest
{
/**
* Determine if the user is authorized to make this request.
*/
public function authorize(): bool
{
return true;
}
/**
* Get the validation rules that apply to the request.
*/
public function rules(): array
{
$companyCurrency = CompanySetting::getSetting('currency', $this->header('company'));
$rules = [
'starts_at' => [
'required',
],
'send_automatically' => [
'required',
'boolean',
],
'customer_id' => [
'required',
],
'exchange_rate' => [
'nullable',
],
'discount' => [
'numeric',
'required',
],
'discount_val' => [
'integer',
'required',
],
'sub_total' => [
'integer',
'required',
],
'total' => [
'integer',
'max:999999999999',
'required',
],
'tax' => [
'required',
],
'status' => [
'required',
],
'exchange_rate' => [
'nullable',
],
'frequency' => [
'required',
],
'limit_by' => [
'required',
],
'limit_count' => [
'required_if:limit_by,COUNT',
],
'limit_date' => [
'required_if:limit_by,DATE',
],
'items' => [
'required',
],
'items.*' => [
'required',
],
];
$customer = Customer::find($this->customer_id);
if ($customer && $companyCurrency) {
if ((string) $customer->currency_id !== $companyCurrency) {
$rules['exchange_rate'] = [
'required',
];
}
}
return $rules;
}
public function getRecurringInvoicePayload()
{
$company_currency = CompanySetting::getSetting('currency', $this->header('company'));
$current_currency = $this->currency_id;
$exchange_rate = $company_currency != $current_currency ? $this->exchange_rate : 1;
$currency = Customer::find($this->customer_id)->currency_id;
$nextInvoiceAt = RecurringInvoice::getNextInvoiceDate($this->frequency, $this->starts_at);
$tax_per_item = CompanySetting::getSetting('tax_per_item', $this->header('company')) ?? 'NO ';
$discount_per_item = CompanySetting::getSetting('discount_per_item', $this->header('company')) ?? 'NO';
// Recompute totals server-side from the line items (GHSA-8c69). The
// recurring template totals propagate to every generated invoice.
$totals = DocumentTotals::compute(
$this->items ?? [],
$this->taxes ?? [],
$this->discount_val,
$tax_per_item,
(bool) $this->tax_included,
$discount_per_item
);
return collect($this->except('items', 'taxes'))
->merge([
'creator_id' => $this->user()->id,
'company_id' => $this->header('company'),
'next_invoice_at' => $nextInvoiceAt,
'tax_per_item' => $tax_per_item,
'discount_per_item' => $discount_per_item,
'sub_total' => $totals['sub_total'],
'total' => $totals['total'],
'tax' => $totals['tax'],
'due_amount' => $totals['total'],
'exchange_rate' => $exchange_rate,
'base_sub_total' => $totals['sub_total'] * $exchange_rate,
'base_total' => $totals['total'] * $exchange_rate,
'base_tax' => $totals['tax'] * $exchange_rate,
'currency_id' => $currency,
])
->toArray();
}
}