nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

web app security fix

Browse Source
This commit is contained in:
Thanakorn S
2026-05-11 13:49:44 +07:00
parent d989e59edc
commit 7a87909392
7 changed files with 107 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/ics/manage_stock_transfer.php
+5 -3
View File
@@ -616,10 +616,12 @@
var from_wh = data.ref.ref_warehouse;
var to_wh = data.ref_warehouse;
// Lock lot/serial
$('#lot_number').html('<option value="' + (data.lot_number || '') + '">' + (data.lot_number || '—') + '</option>')
// Lock lot/serial — use DOM construction (not .html()) to prevent XSS
$('#lot_number').empty()
.append($('<option>').val(data.lot_number || '').text(data.lot_number || '—'))
.val(data.lot_number || '').prop('disabled', true);
$('#serial_number').html('<option value="' + (data.serial_number || '') + '">' + (data.serial_number || '—') + '</option>')
$('#serial_number').empty()
.append($('<option>').val(data.serial_number || '').text(data.serial_number || '—'))
.val(data.serial_number || '').prop('disabled', true);
$('#product_name').val(data.product_name);