* Refresh legacy headers and manifests
* Add Staff Doctrine entities and service fixes
Introduces Doctrine-backed Staff entities/repositories for `admin` and `admin_password_reset`, including lifecycle timestamps and typed lookup helpers. Staff service list retrieval now uses DBAL `fetchAllKeyValue`.
Also refactors Support ticket creation to pass `clientId` instead of loading `Model_Client`, and uses an order lookup by client/order IDs for related ticket data. Product promo failure compensation was tightened to be idempotent by returning early when no redemptions remain and decrementing promo usage by the actual number of removed redemptions. Includes minor import/whitespace/docblock cleanup.
* Fix AdminRepository return type annotation
* Enforce manage_settings for extension config
* Apply suggested fix to src/modules/Servicehosting/tests/Unit/ServiceTest.php from Copilot Autofix
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* 🔒 Add settings permissions for config modules
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Migrate product models; add `promo_redemption`
* Add DomainPricing & ProductOrder repositories
* Use Promo entity typehints and update tests
* Use DI logger, validate order config, update tests
* Replace `error_log` with logger; use stubs in tests
* Use attachOrderConfig and tighten service checks
* Clarify domain defaults and remove deprecated doc tag
* Add missing indexes to `promo_redemption` table
* Enrich promo API arrays and add redemption filters
* Various UI/JS fixes and template cleanups
* Log invoice issues as warnings; expose form_id
* Normalize spelling in UpdatePatcher comment
* Remove checkLimits production method and clean up stale test mocks
* Use getConfig() and add promo permission
* Use container logger directly, remove helpers
* Use defaults for optional Twig settings
* Import macro_functions into admin template
* Compensate promo redemptions on checkout failure
* 🐛 Fix product category and add-on availability handling
* Refactor icon sprite generation and theme builds
* Add svg-sprite to root deps, remove from themes
* Use public_logo_url and logo fallbacks in templates
* Replace xlink:href with href and add icon tools
* Refactor icon sprite build and theme paths
* Replace flag icon styles and update TomSelect
* Replace em dash with colon in update template
* Quote avatar data URI; add .db-avatar styles
* Pagination partial - require url & append hash
* Use defaults in email templates; add delay msg
* Guard Twig template vars with default()
* Replace arrow fn with static closure in test
* Add defaults to email templates and Twig policy
* Guard Twig templates with default filters
* Assert no strict-variable findings with toBeEmpty
* Guard email templates against missing order data
* Make activated_at null-safe in email templates
* 🐛 Use admin recipient in staff reset emails
* Apply suggested fix to src/modules/Theme/Service.php from Copilot Autofix
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Apply suggested fix to src/modules/Theme/Service.php from Copilot Autofix
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Apply suggested fix to src/modules/Theme/Service.php from Copilot Autofix
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Capitalize 'View System Information' display_name
* Guard Orderbutton templates against undefined fields
* Use buildThemeConfig instead of _loadTheme
* Fix Theme ServiceTest::deletePreset mock for findOneByExtensionAndScope
The test invokes deletePreset which internally calls getCurrentThemePreset,
which queries findOneByExtensionAndScope on the repository. The test only
mocked deleteByExtensionAndScope (twice), so the unmocked query threw a
Mockery BadMethodCallException.
Add a mock ExtensionMeta that returns the preset name being deleted, so
getCurrentThemePreset resolves to the same preset and both deleteBy calls
fire as the test already expected.
---------
Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>
* Import template macros and fix invoices tab id
* Handle nulls in Twig extensions and add tests
* Enable Twig strict_variables and add tests
* Improve Twig strict-variables test harness
Fix several undefined-variable issues in admin templates and harden the strict-variables test harness.
- Templates: guard against missing variables by using default() for order_actions and checking header/type in partial_extensions.twig.
- Loader: CombinedTwigLoader now registers theme and module template paths with namespaces (module_area), and includes email template directories.
- Variable collection: VariableCollectorVisitor now collects keys passed via {% embed %} and {% include %} with { ... } so embedded templates get proper stubs.
- Renderer: StrictTemplateRenderer gains better relative template naming for module templates, additional logging for kb_article parsing, and broader classification of render errors as test-infra (typed-return mismatches, NumberFormatter issues, callable/iterable errors, loader quirks) to reduce false positives.
- Tests: add baseline marker files for strict findings, adjust StrictVariablesTest to treat infra findings as informational while failing on real-bug findings, and write findings JSON for review.
Overall these changes reduce noise from the render-everything harness and make the strict-variables suite more robust and actionable.
* Bump test memory limit to 2G via ini_set in bootstrap
The strict-variables render-everything harness parses every FOSSBilling
template and allocates many stubs and AST nodes, which exceeds the
default 128M limit and causes the pest process to exit with 255
mid-suite. Setting the limit in tests/Pest.php means it applies to both
local 'composer test' and CI 'pest --ci' invocations without needing
to modify the workflow file.
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Scope error_reporting suppression to the render-everything harness
* Replace unsupported 'now' Twig global with 'now'|date filter
The reserved 'now' Twig global is only defined in some contexts and is
not present in the install or admin email-template environments. Under
strict_variables it throws a fatal 'Variable "now" does not exist'
error, which crashes the installer and the email template playground.
Both call sites use the date filter to format the current year, so the
correct fix is to feed the filter a string literal: 'now'|date('Y').
This is the same pattern we used for the admin_default and huraga theme
layouts.
Discovered by hitting the install page on the dev instance after the
strict_variables rollout.
* Make sitemap tolerant of missing product.updated_at
The product guest API (Box\Mod\Product\Service::toApiArray) returns
updated_at only for admin requests, not for guests. The sitemap uses
the guest API, so product.updated_at was always undefined for it.
Before strict_variables this was harmless: the date filter silently
returned null and the template rendered. With strict_variables enabled,
the missing key throws 'Key updated_at does not exist', which
get_custom_page catches and converts to a 404.
Pipe through |default('now') so we fall back to the current date when
the field is missing, while still using the real value when present.
Discovered by the live test 'urls return ok status' failing on sitemap.xml
in CI.
* Remove stray blank line in StrictTemplateRenderer
* Fix four templates for strict_variables Cypress failures
The Cypress tests run against a fresh install with strict_variables
enabled, which catches undefined key access in templates that the
non-strict mode silently allowed.
1. mod_invoice_index.html.twig:432
productId is a JavaScript variable, not a Twig variable. The
Twig expression tried to evaluate it server-side and threw
'Variable productId does not exist'. Build the URL with JS
template literal interpolation instead.
2. mod_client_profile.html.twig:158
guest.client_custom_fields is not a real field in the guest
API response. The current lookup threw 'sequence/mapping is
empty' when no custom fields exist. Default to an empty
mapping, then null, and add a truthy guard.
3. mod_support_ticket.html.twig:60
ticket.rel_type is only populated for tickets linked to an
order; the guest response omits it otherwise. Default to
empty string so the comparison still works.
4. mod_support_ticket.html.twig:80
message.author exposes only name and role for client-side
messages, no email. Pass through |default('') so the avatar
function gets a string and renders its fallback.
* Fix client invoice page for strict_variables
The tab labels on the client invoice index reference
unpaid_invoices.total and paid_invoices.total on lines 33/37
to show count badges, but the corresponding {% set %} calls
sit inside the table bodies on lines 53/85. Under
strict_variables this throws 'Variable unpaid_invoices does
not exist' before the lists are ever fetched.
Move both fetches to the top of the content block so the
variables are defined when first read.
* Allow guest checkout rendering under strict vars
* Rename test helper and tweak test expectations
* Guard optional adapter form fields in gateway and build_form templates
The admin payment gateway edit page and the domain registrar build_form
macro both test element[1].description directly in an if condition,
and both read gateway.config[name] / values[name] without a default.
Built-in adapters (Stripe, PayPalEmail, Custom, the Custom registrar)
define form fields with only a label and sometimes validators or
required_when, so on a fresh install the page throws:
Key 'description' for sequence/mapping with keys 'label, validators'
does not exist in 'mod_invoice_gateway.html.twig' at line 115.
The outer '?? ''' on the inner expression does not help: the
exception is thrown when evaluating the if condition, not when
rendering the markdown. With strict_variables on, that becomes a 500.
Replace each 'if element[1].description' with the short-circuit
'is defined and ...' pattern already used in the same file for
required_when, and drop the now-redundant '?? ''' from the inner
expression. Guard the gateway.config[name] / values[name] reads
with |default('') (or |default([]) for the iterable check) so
fields that have not been configured yet do not throw on a fresh
or upgraded install.
Verified on the dev instance:
/admin/invoice/gateway/{1,2} HTTP 200
/admin/servicedomain/registrar/{1,2} HTTP 200
PayPal gateway form save+reload round-trips correctly.
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Enforce one-time payment support per gateway
* Require gateway keys based on mode
* Add update readiness checks and UI integration
* Expose product form_id to guest API output
* Return structured issues and small UI/test tweaks
* Compute gateway field-required; catch Throwable
* Skip unwritable path simulation when root
* Use temp dirs for data/uploads in tests
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix test uploads mkdir error handling
* fix: hide recurrent-only gateways for one-time invoices
* Fix constructor and update install/vendor paths
* Skip update finalization in tests
* Improve exception output in testing mode
* Throw FOSSBilling exception and enhance error log
* Add PHPUnit tests for Box_Log
* Log exception details for CI debugging
* Revise Box_Log tests for PSR-3 and placeholders
* Write exception log to real data dir for CI visibility
* Fix duplicated block in compute_field_required macro
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* Initial plan
* fix: apply template fixes for HTML correctness, accessibility, and i18n
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* Add frontend core, editor adapter & API refactor
* Remove unused Twig macro import and legacy filter
* Move gateway assets to public/gateways
* Include frontend build and assets in Docker image
* Move branding assets to public and refactor build
* Refine update page UI text and styles
* Add 'miterlimit' to cspell word list
* Bump dependencies in composer.lock
* Add esbuild helpers and update imports
* ddev: Node 24, tighten /data & build checks
* Remove .qwen/settings.json
* Docs: expand frontend, build and dev setup
* Add 'docroot' to cspell word list
* Adjust admin alerts and installer warning
* Make dashboard cards full-height and align badges
* Split dashboard cards into partials and add AJAX
* Replace status badges with ribbon elements
* Revamp activity panel layout and responsiveness
* Adjust dashboard card spacing and styles
* Style dashboard links and adjust chart heights
* Back-to-top: update classes and styles
* Fix client admin UI labels and flags
* Improve API response parsing and errors
* Mark action columns no-sort, add table-hover
* Update table classes for hover and wrapping
* Refactor admin templates to card-header layout
* Update admin templates layout and semantics
* Tidy admin templates; remove tabs, update notice
* Standardize admin alert styles and messages
* Handle null/empty status in status_name macro
* Validate resolved renewal price before invoicing
* Keep IP actions inline in activity table
* Right-align activity pagination controls
* Align pagination and export buttons in admin lists
* Improve admin pagination & per-page defaults
* Extract record selector into partial
* Add tab deep-linking and URL hash persistence
* Refactor search controls & capitalize 'One Time'
* Refactor client search filters and toggle state
* Refactor activity filters UI and tomselect styling
* Redesign admin filters; capitalize 'On Hold'
* Revamp admin filter panels (Invoice & Support)
* Group search clause in Massmailer query
* Add filters and expanded search for pages/gateways
* Add filter panels, refine search logic, tests
* Add advanced search filters for activity modules
* Add structured filters, date/ip search & tests
* Add Email queue filters and admin tab
* Add collapsible filter panel to Staff settings
* Refactor badges to use shared macros
* Add massmailer statuses & boolean badges
* Add search icon and refine search input layout
* Update admin templates layout and markup
* Use modals for creating clients/groups
* Centralize tab header action buttons
* Centralize toolbar actions; add Order modal
* Bump Composer dependencies (lockfile)
* Capitalize 'One Time' payment label
* Return raw API body; use button for search
* Wrap search button in input-group-text
* Make search max width configurable
* Fix malformed aria-label Twig expression in layout_default.html.twig
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/c8db6ba9-bda4-413a-989f-e4777e06bd12
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Fix XSS risk in updateExternalIP: append IP via createTextNode instead of innerHTML concat
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/0c435e52-1784-4466-a8dc-c41e12443a6f
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Refactor New Client modal layout and styles
* Limit and style phone country code field
* Use `country_names` helper and `country_name` filter
* Use Symfony Intl for currencies & locales
* Use Symfony Intl for currencies; drop built-in country lists
* Refactor Currency module API, entity and service
* Remove system checkLimits usages from modules and tests
* Remove `currency.title` column and update APIs
* Add inputmode and maxlength to cspell dictionary
* Fix dropdown toggle accessibility: use button instead of anchor
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/b7f9474b-1988-4c08-aec0-f8991edfea71
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Improve multi-currency handling and installer
* Log currency code when changing cart currency
* Use removeCurrency in Admin API and update tests
* Use Intl currency symbols and fraction digits
* Use currency filters in templates
* Rename currency title to name and update schema
* Remove deprecated Service::getLanguages
* Capitalize system permission labels and fix messages
* Use Symfony Countries and remove phone codes list
* Validate country codes; use country select
* Set fb_locale cookie and fix admin locale display
* Validate locales and add default locale selector
* Use Locales::getNames; tweak language selector CSS
* Tweak header spacing and make nav links icon-only
* Localize client login texts
* Add phone country-code attrs and styles
* Center .modal-dialog in two themes
* Add phone_codes API to list calling codes
* Make form the modal-content wrapper
* Move create forms to Bootstrap modals
* Convert new-item tabs to modals in admin UI
* Revamp admin UI, embed snippets & modal
* Revamp admin settings UI and templates
* Revamp Formbuilder & Redirect admin UIs
* Add 'Segoe' and 'minmax' to cspell dictionary
* Rename warning() to warn() in test logger
* Refactor admin templates to card-based layout
* Expose initAvatars globally and scoped init
* Add 'view' permissions and enforce checks
* Refactor Servicehosting admin UI and scripts
* Add staff permission checks and module permissions
* Refactor admin templates layout and forms
* Add staff permission checks and module perms
* Add staff permission checks and module perms
* Refactor admin Twig templates and UI
* Refactor client admin UI to use summary/form cards
* Refactor admin invoice/subscription/transaction templates
* Refactor Order admin UI; fix country labels
* Refactor admin templates and add IP country filter
* Add 'view' permissions and checks to admin APIs
* Use detail/related partials in admin templates
* Refactor admin product templates to use partials
* Add endembed to cspell ignoreWords to fix spellcheck CI failure
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/e8973bef-7364-4b30-8dd8-13701ca15c5d
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Refactor admin templates to use common partials
* Validate order status, add permission checks
* Center form buttons and add horizontal padding
* Introduce createAdminApi and BBTestCaseContainer
* Refactor admin UI templates and forms
* Run intl compression after composer install
* Disable provenance in buildx outputs
* Revamp admin templates for UI and previews
* Refactor admin templates, pricing UI & styles
* Refactor admin invoice sidebar and SEO settings UI
* Use minor currency units, country list & API fixes
* Rename language selector class to locale-selector
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Add `auto_detect_locale` setting, API, UI and tests
* Add public tickets toggle and templates
* Add meta descriptions and OG/canonical tags
* Render invoice gateways as logo buttons
Replace plain radio labels for invoice gateways with a styled button-like radio group: add helper text, wrap gateways in a flex container, generate unique input IDs (`order-gateway-<id>`), use `btn-check` inputs with `.btn` labels showing gateway logos (or title fallback), include tooltip and `aria-label`, and retain the original currency filtering and first-item checked behavior. This updates markup/CSS classes for improved UX and visual clarity without altering payment selection logic.
* Remove plaintext password exposure
* Client welcome email, password reset & tests
* Refactor admin system messages to alerts
* Fix password reset audit IP source
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/d307ec12-1c92-4e31-9369-9d74d3be7a04
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Use Tools::normalizeBoolean for localization settings
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/8329021b-ded8-4906-9615-fb48472ac4b4
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Sanitize invoice hash and secure asset paths
* Guard against missing client session
* Serialize invoice items into indexed inputs
* Validate URL field input type before checking
* Block legacy paid support hooks on ticket create
* Harden CSRF token validation in API client
* Add 'Paidsupport' to cspell word list
* Use Stripe metadata to link client and invoice
* Remove legacy Paidsupport hooks handling
* Add paidsupport to cspell word list
* Use config debug flag; always warn if install exists
* Revert "Use config debug flag; always warn if install exists"
This reverts commit fda6fcc0b05758d897a837d125ce1c0a35be0226.
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix Stripe getClientFromTransaction and simplify UpdatePatcher cache invalidation
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/49a72bff-61f2-4a3e-9107-08aec7b255d2
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Restrict Dompdf logo remote URLs to http/https schemes only
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/58c16027-cc36-4c11-a039-0bfcaf5a45f5
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Enable Buildx cache and add release archive
* Restrict `claimForProcessing` SQL and update tests
* Add HTML sanitizer and sandboxed Twig rendering
* Update test expected HTML in ServiceTest
* Add `RequestFactory` and trusted proxy support
* Use HttpFoundation Responses & Request everywhere
* Return HTTP Response objects for exports/downloads
* Refactor request routing, auth errors and CSV export
* Remove RequestFactory wrapper and minor cleanups
* Specify Response union return types
* Parenthesize response constructions before send
* Clean up PHPStan ignore rules
* Relax HTML test to accept optional tbody/br
* fix(theme): call getUploadedAssets without arguments
Agent-Logs-Url: https://github.com/FOSSBilling/FOSSBilling/sessions/ce04bff6-ccde-4a10-8a68-f6278b1b550e
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: admdly <2807620+admdly@users.noreply.github.com>
* Replace Custom Twig components
Replace custom Twig components with native Twig components, remove unused custom Twig components, and move functionality to macros where appropriate.
m
Update partial_extensions.html.twig
* Update Twig components and migrate to FOSSBilling namespace
* Update Currency module...
* Refactor Twig environment config and loading
* Switch CSRF to cookie-based double-submit
* Add Api Twig extension and restore widget/svg helpers
* Cast language flags; improve JSON parsing
* Add markdown DI service and use in Admin API
* Refactor Twig extensions and markdown, simplify APIs
* Add sandboxed email Twig env, update render APIs
* Fix pagination URL usage and menu class
* Fix HTML markup in email templates
* Use macro for avatars and status badges
* Fix Twig spacing and pagination URL filter order
* Replace Custom Twig components
Replace custom Twig components with native Twig components, remove unused custom Twig components, and move functionality to macros where appropriate.
m
Update partial_extensions.html.twig
* Update Twig components and migrate to FOSSBilling namespace
* Refactor Twig environment config and loading
* Add Api Twig extension and restore widget/svg helpers
* Cast language flags; improve JSON parsing
* Add markdown DI service and use in Admin API
* Refactor Twig extensions and markdown, simplify APIs
* Fix pagination URL usage and menu class
* Fix Twig spacing and pagination URL filter order
* Use `current_theme` global and refactor `period_title`
* Allow markdown and date in email Twig sandbox
* Update email template examples
* Fix Twig URLs, quoting, and logo alt text
* Fix Twig templates: URLs, i18n, search params
* Use `templates/*` directories for module templates
* Tighten Twig sandbox and add tests
* Add Twig environment and template docs to `AGENTS.md`
* Use Symfony Filesystem/Finder and assorted fixes
* Fix ticket reply link fragment concatenation
* Close missing divs in dashboard template
* Use detailed `toApiArray` for client
* Fix module name resolution for email templates
* Regenerate `composer.lock`
* Use `markdown_to_html` filter in admin macro
* Handle null price/quantity and rename test method
* Use `Tools::isHTTPS()` for HTTPS checks
* Add 'area' param to `url` filter and update templates
* Use client area URLs in admin templates
* Use client area and guest API URLs in templates
* Remove client-side invoice delete feature
* Create Twig env via `TwigFactory` for PDF rendering
* Add embedded orderbutton JS and update render
* Add 'srclink' to cspell allowlist
* Use `renderEmailTplString` for email rendering
* Bump twig/markdown-extra to v3.24
* Use `markdown_to_html` for privacy policy
* Escape API JSON, handle null IP, client URLs
* Remove initial admin creation flow
* Handle HTTP failures and make tests robust
* Use `api_url` helper in admin templates
* Use `url` filter for footer link 5
* Add patch53 to remove legacy html templates
* Bump setting last_patch to 53
* Add patch54 to restore legacy email templates
* Use renderEmailTplString for email templating
* Remove redundant else/endif in order template
* Add file-hash cache buster for asset URLs
* Remove raw Twig filter and handle missing modules dir
* Return '-' for future timestamps
* Register and reuse TwigFactory and add CSRF cookie
* Adjust API URL helper and add Twig error handling
* Update composer.lock and package-lock.json
* Add twig_factory to ServiceTest DI
* Use url filter for link_page in template
* Composer - update deps and add markdown-extra
* Remove docblocks and inline comments in `TwigFactory`
* Add patches 53-55 and update `last_patch`
* Add `has_permission` Twig function; exclude `href`
* Remove duplicate network interface form
* Guard removal of legacy dirs; add network input
* Handle null category descriptions in template
* Add Twig adapter env and sandbox policy
* Add 'striptags' to cspell word list
* Update composer.lock (deps updated/removed)
* Sanitize custom payment adapter templates
* Remove redundant legacy API tests
* Bump `last_patch` setting to 56
* Coalesce null before `markdown_to_html`
* Move update patcher to system CLI command
* Remove stray `endif` from recaptcha macro
* Update composer.lock
* Fix extra closing brace in Api ServiceTest
* Fix test errors from main merge
- Remove testGetRequestCount tests (method moved to RateLimiter)
- Remove testGetDi from Staff and System GuestTest (protected method)
- Fix IP error message in testLoginCheckIpException
- Add rate_limiter mock to Staff GuestTest tests that need it
* Fix remaining Staff GuestTest issues
- Add extension service mock for captcha check
- Fix error message from 'User not found' to 'Admin not found'
* Fix Staff GuestTest: update query and add logger mock
* Fix Staff GuestTest: set admin status to active for password reset flow
* Fix stale API calls and inverted required condition
- Notification: replace removed system_string_render with direct output
- Antispam settings: replace |alink/|link with |url/|api_url filters
- build_form macro: fix inverted required condition for non-textarea inputs
* Sanitize JS/data URIs and disable buttons by permission
* Use client login/profile links in support emails
* Encode fb-api JSON and tighten URL sanitization
* Prefer session auth for API key methods
* Remove stray endif and fix template formatting
* Add CSRF token to CSV exports; fix template
* Remove stray endif in currency template
* Make invoice PDF generation return Response
* Fix Twig filters, templates, and form handling
* Remove readonly from anonymous class in test
* Inline DebugBar CSS/JS in renderHead
* Add Bootstrap Tab to global bootstrap
* Capitalize template UI strings
* Use CKEditor API for reply quotes
* Remove WYSIWYG module and move CKEditor to themes
* Bump `last_patch` in install SQL to 59
* Remove Spamchecker module
* Run domain management script only for active orders
* Standardize UI text capitalization & minor fixes
* Remove Spamchecker legacy tests; fix period test
* Rename Spamchecker tests to Antispam
* Restore antispam config in tests; remove fixture
* Refactor Antispam Guest tests for config checks
* Update theme build docs; remove Wysiwyg module
* Remove spamchecker from cspell and tweak comment
* Add spamchecker to cspell word list
* Capitalize 'Update Graphs' button label
* chore: Remove jQuery dependencies and update build system
- Remove jQuery from theme dependencies
- Simplify build configuration
- Update documentation to reflect jQuery removal
- Apply PSR-12 code style formatting
- Replace jQuery with vanilla JS in ClientBalance adapter
* refactor: Complete JavaScript API rewrite with modern architecture
- Rewrite API.js with improved URL handling and CSRF management
- Add reusable utility functions in utils.js
- Remove deprecated jQuery-based bb object
- Update Tom Select integration
* feat: Add Twig API functions for declarative API interaction
- Add fb_api(), fb_api_form(), fb_api_link() Twig functions
- Add asset deduplication to prevent duplicate script/style loading
Note: Dashboard/Index module moved to separate refactor/index PR
* refactor: Integrate new API into theme layouts and core templates
- Update theme layouts to use new API functions
- Convert theme partials and macros
- Update core admin module templates (System, Theme, Wysiwyg, Staff)
* refactor: Update module templates to use new API functions
- Replace data-api-* attributes with fb_api_*() Twig functions
- Remove manual CSRF token handling
- Update all module templates for consistency
Note: Index module excluded (moved to refactor/index PR)
* Remove custom ignore rule from phpstan.neon
Deleted a specific ignore rule for ctype_alnum argument count in src/modules/Extension/Service.php, likely because it is no longer needed or the underlying issue has been resolved.
* Remove Font Awesome from huraga theme and related modules
* Add `aria-hidden` to SVG icons for accessibility
Added the aria-hidden="true" attribute to SVG icons in order button and layout templates to improve accessibility for screen readers.
* Refactor tests to replace depreciated functions
* Update Rector config and dependencies
* Rector: Add explicit string casting for stricter type safety
* Rector: Add return type hints to methods across codebase
* Rector: Increase dead code level and refactor invoice item logic
* Remove unnecessary `willReturn` from test mocks
Eliminate redundant `willReturn(null)` and similar calls from PHPUnit mock setups in legacy module tests, leaving only method expectations. Also update some test values to use floats for consistency.
* Refactor API controller and email adapter return values
* Update formatting and guidelines in `AGENTS.md`
* Replace Twig `include` tag with function
* Replace Twig `attribute` function with dot operator
* Fix spelling issues in mod_order_manage.html.twig
---------
Co-authored-by: John P <64874788+j-a-pope@users.noreply.github.com>
Co-authored-by: Yağızhan <yagizhan49@protonmail.com>
* Make static messages translatable
* Typo
* Second batch
* Make static messages translatable
* Typo
* Second batch
* Applying suggested fixes
* Applying suggested fixes
* Missed this one
* Make documentation section titles untranslatable
* Use double quotes instead of escaping single quotes
* Fix the learn more modal during the installer
Closes#2596
* Hide the quantity option
It doesn't seem to actually be implemented by the back-end logic.
Relates to #2573
* Update Guest.php
* Added a red, scary message
* Added word 'WARNING!'
---------
Co-authored-by: John P <64874788+John-S4@users.noreply.github.com>
* Add space after language, before language code
* Add space in locale.title instead of editing layout
* Consistency & improvements regarding Knowledge Base
* Improve ticket dashboard (at least in my opinion)
* More consistency
* Improve footer copyright in admin panel
* Fix a little display issue - copyright notice should now look great.
* Save some bytes - because why not?
* GitHub is a brand name and does not have to be translated - even more space saved!
* Another improvement
* Sign up -> Register
* Remove hidden useless space after footer
* Improve wording
* Improve wording in ticket dashboard for clarity
* Fix little mistake in the copyright notice
---------
Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
Co-authored-by: Belle Aerni <belleaerni@gmail.com>
* Fixed our Rector config. Closes#2272
* Much improved the product configuration page
Fixed a bug and significantly improved the visuals for that page
* Place the period text after the cost
Closes#2242
* Misc changes
* Slightly shrunk the addon buttons, updated cspell
Adam Daley