boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: code review — XSS, type safety, validation improvements

Browse Source 
Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-03-24 20:13:20 +01:00
parent 3c167cf5c4
commit 106606f3fa
17 changed files with 63 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/routes/admin/trips.ts
View File

@@ -177,9 +177,7 @@ export default async function tripsRoutes(
route_from: String(body.route_from),
route_to: String(body.route_to),
is_business:
body.is_business === true ||
body.is_business === 1 ||
body.is_business === "1",
!!body.is_business,
notes: body.notes ? String(body.notes) : null,
},
});
@@ -231,9 +229,7 @@ export default async function tripsRoutes(
if (body.route_to !== undefined) data.route_to = String(body.route_to);
if (body.is_business !== undefined)
data.is_business =
body.is_business === true ||
body.is_business === 1 ||
body.is_business === "1";
!!body.is_business;
if (body.notes !== undefined)
data.notes = body.notes ? String(body.notes) : null;