boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: code review — XSS, type safety, validation improvements

Browse Source 
Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-03-24 20:13:20 +01:00
parent 3c167cf5c4
commit 106606f3fa
17 changed files with 63 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/admin/pages/AttendanceBalances.tsx
View File

@@ -34,6 +34,7 @@ interface FundUserData {
interface MonthFundData {
month_name: string;
fund: number;
fund_to_date: number;
business_days: number;
users?: Record<string, FundUserData>;
}
@@ -320,7 +321,7 @@ export default function AttendanceBalances() {
let totalCovered = 0;
for (const monthData of Object.values(fundData.months)) {
// Use prorated fund (fund_to_date) for current month, full fund for past
totalFund += (monthData as any).fund_to_date ?? monthData.fund;
totalFund += monthData.fund_to_date ?? monthData.fund;
const us = monthData.users?.[userId];
if (us) {
totalWorked += us.worked;
@@ -571,10 +572,9 @@ export default function AttendanceBalances() {
className="text-secondary"
style={{ fontSize: "12px" }}
>
{(monthData as any).fund_to_date ?? monthData.fund}h (
{monthData.fund_to_date ?? monthData.fund}h (
{Math.round(
((monthData as any).fund_to_date ??
monthData.fund) / 8,
(monthData.fund_to_date ?? monthData.fund) / 8,
)}{" "}
dnů)
</span>
@@ -591,7 +591,7 @@ export default function AttendanceBalances() {
const us = monthData.users?.[String(user.id)];
if (!us) return null;
const effectiveFund =
(monthData as any).fund_to_date ?? monthData.fund;
monthData.fund_to_date ?? monthData.fund;
const pct =
effectiveFund > 0
? Math.min(

5
src/admin/pages/InvoiceDetail.tsx
View File

@@ -5,6 +5,7 @@ import {
useParams,
Link,
} from "react-router-dom";
import DOMPurify from "dompurify";
import { useAlert } from "../context/AlertContext";
import { useAuth } from "../context/AuthContext";
import Forbidden from "../components/Forbidden";
@@ -1969,7 +1970,9 @@ export default function InvoiceDetail() {
<h3 className="admin-card-title">Veřejné poznámky na faktuře</h3>
{isPaid ? (
notes && notes.trim() && notes !== "<p><br></p>" ? (
<div dangerouslySetInnerHTML={{ __html: notes }} />
<div
dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(notes) }}
/>
) : (
<p className="text-tertiary">Žádné poznámky.</p>
)

4
src/admin/pages/OrderDetail.tsx
View File

@@ -5,9 +5,7 @@ import {
useMemo,
type ReactNode,
} from "react";
const DOMPurify = (window as any).DOMPurify || {
sanitize: (html: string) => html,
};
import DOMPurify from "dompurify";
import { useAlert } from "../context/AlertContext";
import { useAuth } from "../context/AuthContext";
import { useParams, useNavigate, Link } from "react-router-dom";

8
src/routes/admin/bank-accounts.ts
View File

@@ -41,9 +41,7 @@ export default async function bankAccountsRoutes(
bic: body.bic ? String(body.bic) : null,
currency: body.currency ? String(body.currency) : "CZK",
is_default:
body.is_default === true ||
body.is_default === 1 ||
body.is_default === "1",
!!body.is_default,
position: body.position ? Number(body.position) : 0,
},
});
@@ -110,9 +108,7 @@ export default async function bankAccountsRoutes(
body.currency !== undefined ? String(body.currency) : undefined,
is_default:
body.is_default !== undefined
? body.is_default === true ||
body.is_default === 1 ||
body.is_default === "1"
? !!body.is_default
: undefined,
position:
body.position !== undefined ? Number(body.position) : undefined,

6
src/routes/admin/company-settings.ts
View File

@@ -215,11 +215,7 @@ export default async function companySettingsRoutes(
}
if (body.default_vat_rate !== undefined)
data.default_vat_rate = Number(body.default_vat_rate);
if (body.require_2fa !== undefined)
data.require_2fa =
body.require_2fa === true ||
body.require_2fa === 1 ||
body.require_2fa === "1";
if (body.require_2fa !== undefined) data.require_2fa = !!body.require_2fa;
if (
body.custom_fields !== undefined ||
body.supplier_field_order !== undefined

8
src/routes/admin/trips.ts
View File

@@ -177,9 +177,7 @@ export default async function tripsRoutes(
route_from: String(body.route_from),
route_to: String(body.route_to),
is_business:
body.is_business === true ||
body.is_business === 1 ||
body.is_business === "1",
!!body.is_business,
notes: body.notes ? String(body.notes) : null,
},
});
@@ -231,9 +229,7 @@ export default async function tripsRoutes(
if (body.route_to !== undefined) data.route_to = String(body.route_to);
if (body.is_business !== undefined)
data.is_business =
body.is_business === true ||
body.is_business === 1 ||
body.is_business === "1";
!!body.is_business;
if (body.notes !== undefined)
data.notes = body.notes ? String(body.notes) : null;

4
src/routes/admin/vehicles.ts
View File

@@ -108,9 +108,7 @@ export default async function vehiclesRoutes(
body.actual_km !== undefined ? Number(body.actual_km) : undefined,
is_active:
body.is_active !== undefined
? body.is_active === true ||
body.is_active === 1 ||
body.is_active === "1"
? !!body.is_active
: undefined,
},
});

4
src/schemas/bank-accounts.schema.ts
View File

@@ -7,7 +7,7 @@ export const CreateBankAccountSchema = z.object({
iban: z.string().nullish(),
bic: z.string().nullish(),
currency: z.string().optional().default("CZK"),
is_default: z.any().optional().default(false),
is_default: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(false),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -22,7 +22,7 @@ export const UpdateBankAccountSchema = z.object({
iban: z.string().nullish(),
bic: z.string().nullish(),
currency: z.string().optional(),
is_default: z.any().optional(),
is_default: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))

2
src/schemas/company-settings.schema.ts
View File

@@ -16,7 +16,7 @@ export const UpdateCompanySettingsSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
require_2fa: z.any().optional(),
require_2fa: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
custom_fields: z.array(z.any()).optional(),
supplier_field_order: z.array(z.any()).optional(),
});

4
src/schemas/invoices.schema.ts
View File

@@ -41,7 +41,7 @@ export const CreateInvoiceSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
payment_method: z.string().nullish(),
constant_symbol: z.string().nullish(),
bank_name: z.string().nullish(),
@@ -73,7 +73,7 @@ export const UpdateInvoiceSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
issue_date: z.union([z.string(), z.null()]).optional(),
due_date: z.union([z.string(), z.null()]).optional(),
tax_date: z.union([z.string(), z.null()]).optional(),

6
src/schemas/offers.schema.ts
View File

@@ -14,7 +14,7 @@ const QuotationItemSchema = z.object({
.transform((v) => Number(v) || 0)
.optional()
.default(0),
is_included_in_total: z.any().optional().default(true),
is_included_in_total: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -46,7 +46,7 @@ export const CreateQuotationSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -73,7 +73,7 @@ export const UpdateQuotationSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))

6
src/schemas/orders.schema.ts
View File

@@ -14,7 +14,7 @@ const OrderItemSchema = z.object({
.transform((v) => Number(v) || 0)
.optional()
.default(0),
is_included_in_total: z.any().optional().default(true),
is_included_in_total: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -55,7 +55,7 @@ export const CreateOrderSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -82,7 +82,7 @@ export const UpdateOrderSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
items: z.array(OrderItemSchema).optional(),
sections: z.array(OrderSectionSchema).optional(),
});

4
src/schemas/trips.schema.ts
View File

@@ -11,7 +11,7 @@ export const CreateTripSchema = z.object({
end_km: z.union([z.number(), z.string()]).transform((v) => Number(v)),
route_from: z.string(),
route_to: z.string(),
is_business: z.any().optional().default(false),
is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(false),
notes: z.string().nullish(),
});
@@ -27,7 +27,7 @@ export const UpdateTripSchema = z.object({
.optional(),
route_from: z.string().optional(),
route_to: z.string().optional(),
is_business: z.any().optional(),
is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
notes: z.string().nullish(),
});

4
src/schemas/users.schema.ts
View File

@@ -7,7 +7,7 @@ export const CreateUserSchema = z.object({
first_name: z.string().min(1, "Jméno je povinné"),
last_name: z.string().min(1, "Příjmení je povinné"),
role_id: z.union([z.number(), z.string()]).transform((v) => Number(v)),
is_active: z.any().optional().default(true),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
});
export const UpdateUserSchema = z.object({
@@ -17,7 +17,7 @@ export const UpdateUserSchema = z.object({
first_name: z.string().optional(),
last_name: z.string().optional(),
role_id: z.union([z.number(), z.string(), z.null()]).optional(),
is_active: z.any().optional(),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
});
export type CreateUserInput = z.infer<typeof CreateUserSchema>;

4
src/schemas/vehicles.schema.ts
View File

@@ -15,7 +15,7 @@ export const CreateVehicleSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(0),
is_active: z.any().optional().default(true),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
});
export const UpdateVehicleSchema = z.object({
@@ -31,7 +31,7 @@ export const UpdateVehicleSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
is_active: z.any().optional(),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
});
export type CreateVehicleInput = z.infer<typeof CreateVehicleSchema>;