M3 Security Fixes for pass 28

This commit is contained in:
Mark Gregory
2026-09-17 10:50:37 +01:00
parent 1037c1c202
commit ed3db89018
77 changed files with 82 additions and 2387 deletions
View File
-27
View File
@@ -1,27 +0,0 @@
<?php
// app/Helpers/USStates.php
namespace Modules\M3\Helpers;
class CAProvinces
{
public static function all()
{
return [
'AB' => 'Alberta',
'BC' => 'British Columbia',
'MB' => 'Manitoba',
'NB' => 'New Brunswick',
'NL' => 'Newfoundland and Labrador',
'NS' => 'Nova Scotia',
'NT' => 'Northwest Territories',
'NU' => 'Nunavut',
'ON' => 'Ontario',
'PE' => 'Prince Edward Island',
'QC' => 'Quebec',
'SK' => 'Saskatchewan',
'YT' => 'Yukon',
];
}
}
-12
View File
@@ -22,7 +22,6 @@ class Helper
if (isset($token)) {
$IonToken = $token;
// Log::info("Cached Token: ".$IonToken);
} else {
// ## CURL
// ## Generate Token
@@ -47,7 +46,6 @@ class Helper
]);
$response = curl_exec($curl);
// dd($response);
$responseJ = json_decode($response);
if ($response === false) {
@@ -58,11 +56,9 @@ class Helper
]);
} elseif (isset($responseJ->access_token)) {
$IonToken = $responseJ->access_token;
// Log::info("New Token: " . $IonToken);
Cache::put('token', $IonToken, now()->addMinutes(59));
} else {
// dd($response);
return response()->json([
'code' => '400',
'status' => 'Failed',
@@ -74,7 +70,6 @@ class Helper
}
return $IonToken;
// return response()->json([
// 'code' => '200',
// 'token' => $IonToken
// ]);
@@ -94,7 +89,6 @@ class Helper
if (isset($token)) {
$IonToken = $token;
// Log::info("Cached Token: ".$IonToken);
} else {
// ## CURL
// ## Generate Token
@@ -119,7 +113,6 @@ class Helper
]);
$response = curl_exec($curl);
// dd($response);
$responseJ = json_decode($response);
curl_close($curl);
@@ -135,7 +128,6 @@ class Helper
]);
} elseif (isset($responseJ->access_token)) {
$IonToken = $responseJ->access_token;
// Log::info("New Token: " . $IonToken);
Cache::put('token', $IonToken, now()->addMinutes(59));
} else {
// Clear Cache
@@ -149,7 +141,6 @@ class Helper
}
}
// return $IonToken;
return response()->json([
'code' => '200',
'token' => $IonToken,
@@ -241,7 +232,6 @@ class Helper
ini_set('max_execution_time', Config::get('arrays.PHPTimeOut'));
$insertSQL = DB::connection(config('m3.connection', 'pgsql'))->table('ICM699M')->insert($data);
// dump($data);
// dump($insertSQL);
}
@@ -282,7 +272,6 @@ class Helper
}
$TYPE = $TYPE == 'integer' || $TYPE == 'DEC' ? 'number' : $TYPE;
// Log::info( $JSONL .' L: '. strlen($JSONL) .' DBL: '. $DBL .' Type:'.$JSONType.':'.$TYPE );
// Check Json Field should be < DB Field
$LengthOK[413] = (strlen($JSONL) <= $DBL) ? true : false;
@@ -322,7 +311,6 @@ class Helper
// $goodString = "";
// }
// dump($goodString);
return $goodString;
}
-36
View File
@@ -1,36 +0,0 @@
<?php
if (! function_exists('m3_user')) {
/**
* Return the current Core username in the format expected by the legacy M3 data.
* M3 previously depended on PHP Basic Auth and read PHP_AUTH_USER directly.
*/
function m3_user(): string
{
$user = auth()->user();
$value = $user?->username
?? $user?->user_name
?? $user?->name
?? $user?->email
?? request()->server('PHP_AUTH_USER')
?? '';
if (str_contains((string) $value, '@')) {
$value = strstr((string) $value, '@', true) ?: $value;
}
return strtoupper(trim((string) $value));
}
}
if (! function_exists('m3_legacy_password')) {
/**
* Passwords are intentionally unavailable in Core. PostgreSQL access uses
* Laravel's configured connection and never reuses a user's login password.
*/
function m3_legacy_password(): string
{
return '';
}
}
@@ -1,14 +0,0 @@
<?php
if (! function_exists('subdirAsset')) {
function subdirAsset($path)
{
return asset((App::environment('production') ? env('APP_DIR') : '') . '/' . $path);
}
}
if (! function_exists('subdirMix')) {
function subdirMix($path)
{
return mix((App::environment('production') ? env('APP_DIR') : '') . '/' . $path);
}
}
-65
View File
@@ -1,65 +0,0 @@
<?php
// app/Helpers/USStates.php
namespace Modules\M3\Helpers;
class USStates
{
public static function all()
{
return [
'AL' => 'Alabama',
'AK' => 'Alaska',
'AZ' => 'Arizona',
'AR' => 'Arkansas',
'CA' => 'California',
'CO' => 'Colorado',
'CT' => 'Connecticut',
'DE' => 'Delaware',
'FL' => 'Florida',
'GA' => 'Georgia',
'HI' => 'Hawaii',
'ID' => 'Idaho',
'IL' => 'Illinois',
'IN' => 'Indiana',
'IA' => 'Iowa',
'KS' => 'Kansas',
'KY' => 'Kentucky',
'LA' => 'Louisiana',
'ME' => 'Maine',
'MD' => 'Maryland',
'MA' => 'Massachusetts',
'MI' => 'Michigan',
'MN' => 'Minnesota',
'MS' => 'Mississippi',
'MO' => 'Missouri',
'MT' => 'Montana',
'NE' => 'Nebraska',
'NV' => 'Nevada',
'NH' => 'New Hampshire',
'NJ' => 'New Jersey',
'NM' => 'New Mexico',
'NY' => 'New York',
'NC' => 'North Carolina',
'ND' => 'North Dakota',
'OH' => 'Ohio',
'OK' => 'Oklahoma',
'OR' => 'Oregon',
'PA' => 'Pennsylvania',
'RI' => 'Rhode Island',
'SC' => 'South Carolina',
'SD' => 'South Dakota',
'TN' => 'Tennessee',
'TX' => 'Texas',
'UT' => 'Utah',
'VT' => 'Vermont',
'VA' => 'Virginia',
'WA' => 'Washington',
'WV' => 'West Virginia',
'WI' => 'Wisconsin',
'WY' => 'Wyoming',
'DC' => 'District of Columbia',
];
}
}