Attention: for version 0.2.1, PHP 8.2 or higher is required. The update will not install on sites with an older PHP version.
Security (version 0.2.0):
- the cost of items in the cart is calculated only on the server;
- importing orders from Excel is available only to a manager; the uploaded file is checked;
- user data is escaped when displayed in order cards, shipment cards, comments on items, and in the orders grid;
- only allowed shipment fields are accepted when placing an order;
- exporting points is available only to an administrator and a manager;
- only the owner of a shipment or a manager can change the shipment comment;
- CSRF protection has been added for module actions;
- Excel exports are protected against executing formulas from user data.
Security (version 0.2.1):
- changing the cart position in the shipment card is limited to price fields; other request fields are no longer accepted;
- changing the status and changing the cart position in the shipment card are protected against CSRF;
- owner verification for the cart position has been strengthened in the legacy cart controller;
- CSRF protection has been added for awarding bonuses, liking items, commenting on items, and exporting transactions;
- the author's name of a comment is escaped in the image attribute;
- the cart property name is escaped in the orders grid column header.
Other changes:
- the module has been migrated to PHP 8.2, dependencies have been updated;
- Excel exports of orders, points, and transactions have been migrated to the current version of PhpSpreadsheet;
- importing orders from Excel is performed immediately, without a background process.