From fcbd5dcae530f6c5c09b850dba3dd783986e490d Mon Sep 17 00:00:00 2001
From: Marcus Moore <contact@marcusmoore.io>
Date: Tue, 26 Nov 2024 11:33:17 -0800
Subject: [PATCH 1/3] Harden asset checkout validation by requiring ints

---
 app/Http/Requests/AssetCheckoutRequest.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/Http/Requests/AssetCheckoutRequest.php b/app/Http/Requests/AssetCheckoutRequest.php
index f48a7d5e53..5234dcac48 100644
--- a/app/Http/Requests/AssetCheckoutRequest.php
+++ b/app/Http/Requests/AssetCheckoutRequest.php
@@ -22,9 +22,9 @@ class AssetCheckoutRequest extends Request
     public function rules()
     {
         $rules = [
-            'assigned_user'         => 'required_without_all:assigned_asset,assigned_location',
-            'assigned_asset'        => 'required_without_all:assigned_user,assigned_location',
-            'assigned_location'     => 'required_without_all:assigned_user,assigned_asset',
+            'assigned_user'         => 'integer|required_without_all:assigned_asset,assigned_location',
+            'assigned_asset'        => 'integer|required_without_all:assigned_user,assigned_location',
+            'assigned_location'     => 'integer|required_without_all:assigned_user,assigned_asset',
             'status_id'             => 'exists:status_labels,id,deployable,1',
             'checkout_to_type'      => 'required|in:asset,location,user',
             'checkout_at' => [

From ee4a54be247840ccf427295739975eb882f311c2 Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Wed, 27 Nov 2024 15:48:13 +0000
Subject: [PATCH 2/3] Fixed order by notes for users

Signed-off-by: snipe <snipe@snipe.net>
---
 app/Http/Controllers/Api/UsersController.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Http/Controllers/Api/UsersController.php b/app/Http/Controllers/Api/UsersController.php
index bd7ae1a668..61aad10734 100644
--- a/app/Http/Controllers/Api/UsersController.php
+++ b/app/Http/Controllers/Api/UsersController.php
@@ -283,6 +283,7 @@ class UsersController extends Controller
                         'autoassign_licenses',
                         'website',
                         'locale',
+                        'notes',
                     ];
 
                 $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'first_name';

From 716c67d4b858f45d0d59a2fde808a9a35f6aff48 Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Mon, 2 Dec 2024 15:45:07 +0000
Subject: [PATCH 3/3] Fixed #15901 - re-added required indicator on text and
 select custom fields

Signed-off-by: snipe <snipe@snipe.net>
---
 .../views/models/custom_fields_form.blade.php | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/resources/views/models/custom_fields_form.blade.php b/resources/views/models/custom_fields_form.blade.php
index 8d414f337d..87d58874b9 100644
--- a/resources/views/models/custom_fields_form.blade.php
+++ b/resources/views/models/custom_fields_form.blade.php
@@ -2,20 +2,22 @@
   @foreach($model->fieldset->fields AS $field)
     <div class="form-group{{ $errors->has($field->db_column_name()) ? ' has-error' : '' }}">
       <label for="{{ $field->db_column_name() }}" class="col-md-3 control-label">{{ $field->name }} </label>
-      <div class="col-md-7 col-sm-12{{ ($field->pivot->required=='1') ? ' required' : '' }}">
+      <div class="col-md-7 col-sm-12">
 
 
           @if ($field->element!='text')
-              <!-- Listbox -->
+
               @if ($field->element=='listbox')
+                  <!-- Listbox -->
                    {{ Form::select($field->db_column_name(), $field->formatFieldValuesAsArray(),
-                  old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))), ['class'=>'format select2 form-control']) }}
+                  old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))), ['class' => 'format select2 form-control',  ($field->pivot->required=='1' ? ' required' : '') ]) }}
 
               @elseif ($field->element=='textarea')
-                  <textarea class="col-md-6 form-control" id="{{ $field->db_column_name() }}" name="{{ $field->db_column_name() }}">{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}</textarea>
+                  <!-- Textarea -->
+                  <textarea class="col-md-6 form-control" id="{{ $field->db_column_name() }}" name="{{ $field->db_column_name() }}"{{ ($field->pivot->required=='1') ? ' required' : '' }}>{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}</textarea>
 
               @elseif ($field->element=='checkbox')
-                    <!-- Checkboxes -->
+                  <!-- Checkbox -->
                   @foreach ($field->formatFieldValuesAsArray() as $key => $value)
                       <div>
                           <label class="form-control">
@@ -26,27 +28,25 @@
                   @endforeach
 
               @elseif ($field->element=='radio')
-              @foreach ($field->formatFieldValuesAsArray() as $value)
-
-              <div>
-                  <label class="form-control">
-                      <input type="radio" value="{{ $value }}" name="{{ $field->db_column_name() }}" {{ isset($item) ? ($item->{$field->db_column_name()} == $value ? ' checked="checked"' : '') : (old($field->db_column_name()) != '' ? ' checked="checked"' : (in_array($value, explode(', ', $field->defaultValue($model->id))) ? ' checked="checked"' : '')) }}>
-                      {{ $value }}
-                  </label>
-              </div>
-          @endforeach
-
+                  <!-- Radio -->
+                  @foreach ($field->formatFieldValuesAsArray() as $value)
+                      <div>
+                          <label class="form-control">
+                              <input type="radio" value="{{ $value }}" name="{{ $field->db_column_name() }}" {{ isset($item) ? ($item->{$field->db_column_name()} == $value ? ' checked="checked"' : '') : (old($field->db_column_name()) != '' ? ' checked="checked"' : (in_array($value, explode(', ', $field->defaultValue($model->id))) ? ' checked="checked"' : '')) }}>
+                              {{ $value }}
+                          </label>
+                      </div>
+                  @endforeach
               @endif
 
 
           @else
             <!-- Date field -->
-
                 @if ($field->format=='DATE')
 
                         <div class="input-group col-md-5" style="padding-left: 0px;">
                             <div class="input-group date" data-provide="datepicker" data-date-format="yyyy-mm-dd" data-autoclose="true" data-date-clear-btn="true">
-                                <input type="text" class="form-control" placeholder="{{ trans('general.select_date') }}" name="{{ $field->db_column_name() }}" id="{{ $field->db_column_name() }}" readonly value="{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}"  style="background-color:inherit">
+                                <input type="text" class="form-control" placeholder="{{ trans('general.select_date') }}" name="{{ $field->db_column_name() }}" id="{{ $field->db_column_name() }}" readonly value="{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}"  style="background-color:inherit"{{ ($field->pivot->required=='1') ? ' required' : '' }}>
                                 <span class="input-group-addon"><x-icon type="calendar" /></span>
                             </div>
                         </div>
@@ -54,7 +54,7 @@
 
                 @else
                     @if (($field->field_encrypted=='0') || (Gate::allows('assets.view.encrypted_custom_fields')))
-                    <input type="text" value="{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}" id="{{ $field->db_column_name() }}" class="form-control" name="{{ $field->db_column_name() }}" placeholder="Enter {{ strtolower($field->format) }} text">
+                    <input type="text" value="{{ old($field->db_column_name(),(isset($item) ? Helper::gracefulDecrypt($field, $item->{$field->db_column_name()}) : $field->defaultValue($model->id))) }}" id="{{ $field->db_column_name() }}" class="form-control" name="{{ $field->db_column_name() }}" placeholder="Enter {{ strtolower($field->format) }} text"{{ ($field->pivot->required=='1') ? ' required' : '' }}>
                         @else
                             <input type="text" value="{{ strtoupper(trans('admin/custom_fields/general.encrypted')) }}" class="form-control disabled" disabled>
                     @endif