From e050b47a1ce5642d50484499ecd79669ebad9fb3 Mon Sep 17 00:00:00 2001 From: Mark Gregory Date: Thu, 17 Sep 2026 10:58:46 +0100 Subject: [PATCH] M3 Security Fixes for pass 30 --- .../Controllers/OrderLinesOfClosedOrder.php | 105 ++++++++---------- 1 file changed, 46 insertions(+), 59 deletions(-) diff --git a/Modules/M3/Http/Controllers/OrderLinesOfClosedOrder.php b/Modules/M3/Http/Controllers/OrderLinesOfClosedOrder.php index 519b8ce7..3dbf92ea 100644 --- a/Modules/M3/Http/Controllers/OrderLinesOfClosedOrder.php +++ b/Modules/M3/Http/Controllers/OrderLinesOfClosedOrder.php @@ -22,20 +22,7 @@ class OrderLinesOfClosedOrder extends Controller $REPORTDATEDisp = today()->format('Ymd'); $allReportsUrls = []; try { - $SHUSER = m3_user() !== '' ? Str::upper(trim(m3_user())) : ''; - - if ($SHUSER != '') { - // Get User CO & WH from Table ICM428M - $ICM428M = DB::connection(config('m3.connection', 'pgsql'))->table('icm428m') - ->select('R428US', 'R428CO', 'R428WH', 'R428PL') - ->where('R428US', '=', $SHUSER) - ->first(); - - $R428US = isset($ICM428M->R428US) ? $ICM428M->R428US : ''; // User - $COMPANY = isset($ICM428M->R428CO) ? $ICM428M->R428CO : '110'; // Company - $PLANT = isset($ICM428M->R428PL) ? $ICM428M->R428PL : '144'; // Plant - $WHS = isset($ICM428M->R428WH) ? $ICM428M->R428WH : '322'; // WareHouse - } + [$COMPANY, $PLANT, $WHS] = self::userWarehouseContext('110', '144', '322'); // Warehouse Table $IC670M = DB::connection(config('m3.connection', 'pgsql'))->table('ic670m')->get(); @@ -84,18 +71,7 @@ class OrderLinesOfClosedOrder extends Controller } // Get List of Files - $allReportsUrls = []; - if ($WHS == '321') { - $files = Storage::disk('publicCL')->files(); - } else { - $files = Storage::disk('publicCL')->allFiles($WHS); - } - - foreach ($files as $file) { - // Get the file URL (if URL is configured in filesystems.php) - $url = Storage::disk('publicCL')->url($file); - $allReportsUrls[$file] = $url; - } + $allReportsUrls = self::reportUrls($WHS); } catch (\Throwable $th) { Log::error($th); @@ -112,20 +88,7 @@ class OrderLinesOfClosedOrder extends Controller ini_set('memory_limit', '1024M'); try { - $SHUSER = m3_user() !== '' ? Str::upper(trim(m3_user())) : ''; - - if ($SHUSER != '') { - // Get User CO & WH from Table ICM428M - $ICM428M = DB::connection(config('m3.connection', 'pgsql'))->table('icm428m') - ->select('R428US', 'R428CO', 'R428WH', 'R428PL') - ->where('R428US', '=', $SHUSER) - ->first(); - - $R428US = isset($ICM428M->R428US) ? $ICM428M->R428US : ''; // User - $COMPANY = isset($ICM428M->R428CO) ? $ICM428M->R428CO : ''; // Company - $PLANT = isset($ICM428M->R428PL) ? $ICM428M->R428PL : ''; // Plant - $WHS = isset($ICM428M->R428WH) ? $ICM428M->R428WH : ''; // WareHouse - } + [$COMPANY, $PLANT, $WHS] = self::userWarehouseContext(); // Warehouse Table $IC670M = DB::connection(config('m3.connection', 'pgsql'))->table('ic670m')->get(); @@ -209,20 +172,7 @@ class OrderLinesOfClosedOrder extends Controller ini_set('memory_limit', '1024M'); try { - $SHUSER = m3_user() !== '' ? Str::upper(trim(m3_user())) : ''; - - if ($SHUSER != '') { - // Get User CO & WH from Table ICM428M - $ICM428M = DB::connection(config('m3.connection', 'pgsql'))->table('icm428m') - ->select('R428US', 'R428CO', 'R428WH', 'R428PL') - ->where('R428US', '=', $SHUSER) - ->first(); - - $R428US = isset($ICM428M->R428US) ? $ICM428M->R428US : ''; // User - $COMPANY = isset($ICM428M->R428CO) ? $ICM428M->R428CO : ''; // Company - $PLANT = isset($ICM428M->R428PL) ? $ICM428M->R428PL : ''; // Plant - $WHS = isset($ICM428M->R428WH) ? $ICM428M->R428WH : ''; // WareHouse - } + [$COMPANY, $PLANT, $WHS] = self::userWarehouseContext(); // Warehouse Table $IC670M = DB::connection(config('m3.connection', 'pgsql'))->table('ic670m')->get(); @@ -288,11 +238,7 @@ class OrderLinesOfClosedOrder extends Controller $ICM688M2Col = ''; } - if ($WHS == '321') { - $prevMonthFile = 'Closedorderlinesreport_' . $reportDateWD . '-' . $toreportDateWD . self::XLSX_EXTENSION; - } else { - $prevMonthFile = $WHS . '/Closedorderlinesreport_' . $reportDateWD . '-' . $toreportDateWD . '-' . $WHS . self::XLSX_EXTENSION; - } + $prevMonthFile = self::storedReportName($WHS, $reportDateWD, $toreportDateWD); // MAK Store the File to Storage app(SpreadsheetExport::class)->store($ICM688M2Col, $prevMonthFile, 'publicCL'); @@ -305,6 +251,47 @@ class OrderLinesOfClosedOrder extends Controller } } + private static function userWarehouseContext(string $defaultCompany = '', string $defaultPlant = '', string $defaultWarehouse = ''): array + { + $user = trim((string) m3_user()); + if ($user === '') { + return [$defaultCompany, $defaultPlant, $defaultWarehouse]; + } + + $profile = DB::connection(config('m3.connection', 'pgsql'))->table('icm428m') + ->select('R428CO', 'R428WH', 'R428PL') + ->where('R428US', Str::upper($user)) + ->first(); + + return [ + $profile->R428CO ?? $defaultCompany, + $profile->R428PL ?? $defaultPlant, + $profile->R428WH ?? $defaultWarehouse, + ]; + } + + private static function reportUrls(string $warehouse): array + { + $disk = Storage::disk('publicCL'); + $files = $warehouse === '321' ? $disk->files() : $disk->allFiles($warehouse); + $urls = []; + + foreach ($files as $file) { + $urls[$file] = $disk->url($file); + } + + return $urls; + } + + private static function storedReportName(string $warehouse, string $from, string $to): string + { + $name = 'Closedorderlinesreport_' . $from . '-' . $to; + + return $warehouse === '321' + ? $name . self::XLSX_EXTENSION + : $warehouse . '/' . $name . '-' . $warehouse . self::XLSX_EXTENSION; + } + // Download File public static function downloadFiles(Request $request) {