nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

code audit fixes: require_once, issue flow, role guards

Browse Source
This commit is contained in:
Thanakorn S
2026-05-23 17:06:08 +07:00
parent 54f3f11fd2
commit 5ca6b49fd0
191 changed files with 534 additions and 464 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/order/api/engine/cancel_order.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/OrderManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/cancel_return.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/ReturnManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/ReturnManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/confirm_order.php
+5 -5
View File
@@ -1,11 +1,11 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/OrderManager.php';
require '../../../assets/utils/classes/StockManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/StockManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/confirm_return.php
+4 -4
View File
@@ -1,10 +1,10 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/ReturnManager.php';
require '../../../assets/utils/classes/InvoiceManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/ReturnManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/delete_invoice.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/delete_order.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/OrderManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/delete_return.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/ReturnManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/ReturnManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/issue_invoice.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$id = (int)($data['id'] ?? ($data['invoice_id'] ?? 0));
$due_date = trim((string)($data['due_date'] ?? ''));
app/order/api/engine/manage_invoice.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/UsageGuard.php';
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/UsageGuard.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
try {
$action = $data['action'] ?? 'update';
app/order/api/engine/manage_order.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/UsageGuard.php';
require '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/UsageGuard.php';
require_once '../../../assets/utils/classes/OrderManager.php';
// Decode items JSON string back to array
$data['items'] = json_decode($data['items'] ?? '[]', true) ?: [];
app/order/api/engine/manage_return.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/ReturnManager.php';
require_once '../../../assets/utils/classes/ReturnManager.php';
$action = $data['action'] ?? 'save';
$data['items'] = json_decode($data['items'] ?? '[]', true) ?: [];
app/order/api/engine/proceed_to_credit_note.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$return_id = (int)($data['return_id'] ?? 0);
app/order/api/engine/proceed_to_invoice.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$order_id = (int)($data['order_id'] ?? 0);
app/order/api/engine/retrieve_invoice.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$inv = new InvoiceManager($pdo2, $company_id);
$id = (int)($data['invoice_id'] ?? 0);
app/order/api/engine/retrieve_order.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/OrderManager.php';
$order = new OrderManager($pdo2, $company_id);
app/order/api/engine/retrieve_return.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/ReturnManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/ReturnManager.php';
$ret = new ReturnManager($pdo2, $company_id);
$id = (int)($data['id'] ?? 0);
app/order/api/engine/update_invoice_status.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$id = (int)($data['invoice_id'] ?? 0);
$status = (int)($data['status'] ?? 0);
app/order/api/engine/update_order_status.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/OrderManager.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
$id = (int)($data['id'] ?? 0);
app/order/api/engine/void_invoice.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$id = (int)($data['id'] ?? 0);