mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

m3 Security Fixes

Browse Source
This commit is contained in:
Mark Gregory
2026-09-16 17:14:26 +01:00
parent 1602bdd72e
commit d68687f062
78 changed files with 1297 additions and 1228 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/M3/Config/arrays.php
-1
View File
@@ -95,4 +95,3 @@ return [
], ],
]; ];
Modules/M3/Http/Controllers/API/M3Controller.php
+76 -6
View File
@@ -288,14 +288,84 @@ class M3Controller extends Controller
# Initialise Table Fields to be filled # Initialise Table Fields to be filled
$InsertArray = []; $InsertArray = [];
$fieldValues = [
'Company' => $Company,
'Warehouse' => $Warehouse,
'Plant' => $Plant,
'PickerNumber' => $PickerNumber,
'OrderNumber' => $OrderNumber,
'ReleaseNumber' => $ReleaseNumber,
'ShipmentNumber' => $ShipmentNumber,
'OrderLine' => $OrderLine,
'PartNumber' => $PartNumber,
'Description' => $Description,
'Quantity' => $Quantity,
'BaseUnitPrice' => $BaseUnitPrice,
'Currency' => $Currency,
'Zone' => $Zone,
'PromDate' => $PromDate,
'RouteCode' => $RouteCode,
'BillToId' => $BillToId,
'ShipToId' => $ShipToId,
'CompanyName' => $CompanyName,
'Address1' => $Address1,
'Address2' => $Address2,
'Address3' => $Address3,
'Address4' => $Address4,
'City' => $City,
'State' => $State,
'PostalCode' => $PostalCode,
'Country' => $Country,
'CountryName' => $CountryName,
'PartWeight' => $PartWeight,
'SellUOM' => $SellUOM,
'PartConv' => $PartConv,
'CarrierCode' => $CarrierCode,
'ShipVia' => $ShipVia,
'PrimaryLocation' => $PrimaryLocation,
'Allocation' => $Allocation,
'AllocatedTo' => $AllocatedTo,
'LocationSeq' => $LocationSeq,
'UOM' => $UOM,
'HazMat' => $HazMat,
'PartUPC' => $PartUPC,
'PartEAN' => $PartEAN,
'LotFlag' => $LotFlag,
'ManOrd' => $ManOrd,
'LotNumber' => $LotNumber,
'ProductArea' => $ProductArea,
'FreightClass' => $FreightClass,
'ShipmentPONumber' => $ShipmentPONumber,
'ShipmentPOLine' => $ShipmentPOLine,
'ShipTerms' => $ShipTerms,
'ExchangeRate' => $ExchangeRate,
'OrderClass' => $OrderClass,
'LocationType' => $LocationType,
'PallSize' => $PallSize,
'MasterCarton' => $MasterCarton,
'MasterQty' => $MasterQty,
'InnerQty' => $InnerQty,
'PalletQty' => $PalletQty,
'CartonQty' => $CartonQty,
'PersonName' => $PersonName,
'AccountNo' => $AccountNo,
'Email' => $Email,
'OrderCategory' => $OrderCategory,
'A1DATEADD' => $A1DATEADD,
'A1TIMEADD' => $A1TIMEADD,
'KitPartNumber' => $KitPartNumber,
'OrderLineSuffix' => $OrderLineSuffix,
'CustomerPartNumber' => $CustomerPartNumber,
'GS1Label' => $GS1Label,
'CurrencyExchangeRate' => $CurrencyExchangeRate,
];
# Check JSON fields if empty or > DB Fields # Check JSON fields if empty or > DB Fields
foreach ($ICM666MFields as $key => $value) { foreach ($ICM666MFields as $key => $value) {
$keyVar = $key;
# Sanitize String # Sanitize String
$$keyVar = Helper::sanityzeString($$keyVar); $fieldValue = Helper::sanityzeString($fieldValues[$key] ?? '');
# Check Var Types & Length # Check Var Types & Length
$LengthTest = Helper::checkLength($$keyVar, $value[1], $value[2]); $LengthTest = Helper::checkLength($fieldValue, $value[1], $value[2]);
if (!$LengthTest[413] || !$LengthTest[411] || !$LengthTest[417]) { if (!$LengthTest[413] || !$LengthTest[411] || !$LengthTest[417]) {
// Log::error($key .' :: '. $value[0].' :: '. $value[1] .' JSONF: '.$$keyVar .' Type: '.$value[2] ); // Log::error($key .' :: '. $value[0].' :: '. $value[1] .' JSONF: '.$$keyVar .' Type: '.$value[2] );
@@ -315,8 +385,8 @@ class M3Controller extends Controller
Helper::logToICM699M($data); Helper::logToICM699M($data);
return response()->json($message); return response()->json($message);
} else if ($$keyVar != '') { } else if ($fieldValue != '') {
$InsertArray[$value[0]] = $$keyVar; $InsertArray[$value[0]] = $fieldValue;
} }
} }
// Log::info($InsertArray); // Log::info($InsertArray);
@@ -354,7 +424,7 @@ class M3Controller extends Controller
# connect to toolkit using DB2 credentials (can also leave blank for default authority) # connect to toolkit using DB2 credentials (can also leave blank for default authority)
try { try {
$conn = app(\Modules\M3\Services\PostgresProgramBridge::class); $conn = app(\Modules\M3\Services\PostgresProgramBridge::class);
} catch (Exception $e) { } catch (\Exception $e) {
# Determine reason for failure. # Determine reason for failure.
# Probably database authentication error or invalid or unreachable database. # Probably database authentication error or invalid or unreachable database.
$code = $e->getCode(); $code = $e->getCode();
Modules/M3/Http/Controllers/userControlController.php
+3 -3
View File
@@ -74,7 +74,7 @@ class userControlController extends Controller
try { try {
$conn = app(\Modules\M3\Services\PostgresProgramBridge::class); $conn = app(\Modules\M3\Services\PostgresProgramBridge::class);
} }
catch (Exception $e) catch (\Exception $e)
{ {
// Determine reason for failure. // Determine reason for failure.
// Probably database authentication error or invalid or unreachable database. // Probably database authentication error or invalid or unreachable database.
@@ -183,7 +183,7 @@ class userControlController extends Controller
try { try {
$conn = app(\Modules\M3\Services\PostgresProgramBridge::class); $conn = app(\Modules\M3\Services\PostgresProgramBridge::class);
} }
catch (Exception $e) catch (\Exception $e)
{ {
// Determine reason for failure. // Determine reason for failure.
// Probably database authentication error or invalid or unreachable database. // Probably database authentication error or invalid or unreachable database.
@@ -284,7 +284,7 @@ class userControlController extends Controller
#dump($conn); #dump($conn);
#echo "B4<br>"; #echo "B4<br>";
} }
catch (Exception $e) catch (\Exception $e)
{ {
#echo "B5<br>"; #echo "B5<br>";
// Determine reason for failure. // Determine reason for failure.
Modules/M3/Http/Controllers/utilitiesContoller.php
+1 -1
View File
@@ -38,7 +38,7 @@ class utilitiesContoller extends Controller
// connect to toolkit using DB2 credentials (can also leave blank for default authority) // connect to toolkit using DB2 credentials (can also leave blank for default authority)
try { try {
$conn = app(\Modules\M3\Services\PostgresProgramBridge::class); $conn = app(\Modules\M3\Services\PostgresProgramBridge::class);
} catch (Exception $e) { } catch (\Exception $e) {
// Determine reason for failure. // Determine reason for failure.
// Probably database authentication error or invalid or unreachable database. // Probably database authentication error or invalid or unreachable database.
$code = $e->getCode(); $code = $e->getCode();