Fix QA review findings: server-side validation, notes encoding, dashboard totals

Validate document lines on the server and recompute their totals, store notes with quotes/markup/emoji (utf8mb4, idempotent escaping, decode in form fields), exclude transfers from company-wide stock in/out, count revenue from confirmed orders only, one low-stock rule everywhere, list unapproved lots, natural bin sort, stable order/PO sort, status tiles that add up.
2026-09-19 10:58:42 +07:00
parent de760d02da
commit c89b28da4c
32 changed files with 924 additions and 483 deletions
@@ -141,6 +141,12 @@ $answer = array("success"=>0, "message"=>"");
 if (isset($_POST['json'])) {
 // Old Method: Data is wrapped in a JSON string
 $data = json_decode($_POST['json'], true);
+if (!is_array($data)) {
+    // An undecodable payload used to carry on as an empty request.
+    http_response_code(400);
+    $answer["message"] = "The request could not be read. Please reload the page and try again.";
+    exit(json_encode($answer));
+}
 } else if (isset($_POST['otp'])) { 
    // New Method: Data is sent directly (FormData)
    // We check for 'otp' because every request should have one