nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

code audit fixes: require_once, issue flow, role guards

Browse Source
This commit is contained in:
Thanakorn S
2026-05-23 17:06:08 +07:00
parent 54f3f11fd2
commit 5ca6b49fd0
191 changed files with 534 additions and 464 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/po/api/engine/cancel_po.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/cancel_supplier_return.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/SupplierReturnManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/SupplierReturnManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$return_id = (int)($data['id'] ?? 0);
app/po/api/engine/close_po.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/confirm_po.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/confirm_supplier_return.php
+4 -4
View File
@@ -1,10 +1,10 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/SupplierReturnManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/SupplierReturnManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
$return_id = (int)($data['id'] ?? 0);
app/po/api/engine/delete_po.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/delete_purchase_request.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/PurchaseRequestManager.php';
require_once '../../../assets/utils/classes/PurchaseRequestManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/delete_supplier_return.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require '../../../assets/utils/classes/SupplierReturnManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/SupplierReturnManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/manage_po.php
+3 -3
View File
@@ -1,9 +1,9 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/UsageGuard.php';
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/UsageGuard.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$data['items'] = json_decode($data['items'] ?? '[]', true) ?: [];
app/po/api/engine/manage_supplier_return.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/SupplierReturnManager.php';
require_once '../../../assets/utils/classes/SupplierReturnManager.php';
$mgr = new SupplierReturnManager($pdo2, $company_id);
app/po/api/engine/proceed_to_purchase_invoice.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$po_id = (int)($data['po_id'] ?? 0);
app/po/api/engine/proceed_to_supplier_credit_note.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/InvoiceManager.php';
require_once '../../../assets/utils/classes/InvoiceManager.php';
$return_id = (int)($data['return_id'] ?? 0);
app/po/api/engine/receive_po.php
+4 -4
View File
@@ -1,10 +1,10 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require '../../../assets/utils/classes/StockManager.php';
require '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/StockManager.php';
require_once '../../../assets/utils/classes/WarehouseManager.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
$id = (int)($data['id'] ?? 0);
app/po/api/engine/retrieve_po.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$po = new PurchaseOrderManager($pdo2, $company_id);
app/po/api/engine/retrieve_supplier_return.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/SupplierReturnManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/SupplierReturnManager.php';
$mgr = new SupplierReturnManager($pdo2, $company_id);
$id = (int)($data['id'] ?? 0);
app/po/api/engine/update_po_payment.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin', 'staff']);
require '../../../assets/utils/classes/PurchaseOrderManager.php';
require_once '../../../assets/utils/classes/PurchaseOrderManager.php';
$id = (int)($data['id'] ?? 0);
$payment_status = (int)($data['payment_status'] ?? 0);