Repository: opensourcepos/opensourcepos (language: php)

Issue:
CI4: Bootstrap-table header broken on scroll
bootstrap-table handles creating the table header and body. The header is pinned during scroll, which is good, but on scroll it breaks causing the formerly non-visible header columns to appear and scrolling to no longer be fixed to the table.

![image](https://github.com/opensourcepos/opensourcepos/assets/17935339/cf54178b-c38e-483c-8b65-05618d3ac345)

You can see below that the header row is decoupled in horizontal scrolling from the table body.  This does not happen when the header is not trying to pin itself.
![image](https://github.com/opensourcepos/opensourcepos/assets/17935339/d7edd7d1-d659-40bc-9071-32419ded8ba6)

CI4: Possible duplicate import of PSR LoggerInterface
PHPStorm is complaining about two different instances of PSR\Log\LoggerInterface classes.

One is in `\vendor\psr\log\PSR\log` and the other is in `\vendor\codeigniter4\framework\system\ThirdParty\PSR\log`

![image](https://user-images.githubusercontent.com/17935339/215047869-aa10558a-3cb1-4e42-90a6-e7b49706c169.png)

![image](https://user-images.githubusercontent.com/17935339/215047805-befe5298-443f-48a8-a1b3-41fc0f6010e6.png)

It seems like since PSR\log is now included in CI4, we should remove the duplicate.  This happens during the npm install and I'm seeing the psr/log reference in the composer.lock file as a CodeIgniter dependency. I'm not sure the best way to remedy this because I believe the composer.lock file is automatically generated.


Discussion / hints:
I upgraded the version of bootstrap-table to 1.22.1, but the issue persists.  I was able to duplicate the issue on the bootstrap-table demo page of their website, so this is an issue specific to the StickyHeaders functionality in bootstrap-table. I created an issue in their repo https://github.com/wenzhixin/bootstrap-table/issues/7090
Thanks for looking into this @objecttothis ! I wonder if there would be a way to make the table more responsive.
> Thanks for looking into this @objecttothis ! I wonder if there would be a way to make the table more responsive.

It's responsive for large and medium screens but not for small.  It's possible that moving everything to bootstrap 5 will make it easier to make the entire table responsive.  Likely the goal will be to specify how wide the table view is able to get down to and possibly to make the footer sticky on small displays. We may need to replace bootstrap-table if it can't do these things.

I just checked this example on their site (https://examples.bootstrap-table.com/) and it's much more responsive with sticky footers, so it looks like we may be able to make it work... they are using Bootstrap 5 though.
I saw some activity in the bootstrap tables project for this one, will check if we can upgrade to the latest commit.

I managed to bump the bootstrap table, had to upgrade the travis env to ubuntu jammy and now using a native node installation on that one instead of docker.
I will however try to fix the version to a specific commit hash for bstables  
![Screenshot from 2023-12-29 21-02-28](https://github.com/opensourcepos/opensourcepos/assets/576234/41566361-3f11-4a17-a761-ccebf76a60b6)

@objecttothis would the screencap here prove that the issue is fixed?
> @objecttothis would the screencap here prove that the issue is fixed?

The issue wasn't with the table header alignment in it's un-scrolled position. The issue only appears after you scroll past the top of the table and the header goes into "sticky" mode.  Can you confirm that scrolling down so that the header goes into sticky mode does not exhibit the misalignment issue?
![image](https://github.com/opensourcepos/opensourcepos/assets/576234/7d78a45d-0c8d-421d-976d-755587311034)

The bootstrap tables issue was closed so that is why I thought it was fixed, but indeed, when I resize the window to make the headers sticky then it does not align with the body
> The bootstrap tables issue was closed so that is why I thought it was fixed, but indeed, when I resize the window to make the headers sticky then it does not align with the body

He reopened it right after. I think it was because he had mentioned the issue in a PR that was merged.
The latest release of bootstrap tables is now 1.22.2 and there are some commits since then, but the issue does not seem to have been address so far.  This will be on hold until the issue is resolved in bootstrap tables.
I bumped bootstrap-tables to 1.22.4. Issue persists.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

Could be handled as follows: https://stackoverflow.com/questions/34637657/is-it-possible-to-ignore-child-dependencies-in-composer-config

Fix patch:
diff --git a/app/Config/App.php b/app/Config/App.php
index 2eacd2de7..abed4897e 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -277,7 +277,7 @@ class App extends BaseConfig
 	 * @see http://www.html5rocks.com/en/tutorials/security/content-security-policy/
 	 * @see http://www.w3.org/TR/CSP/
 	 */
-	public bool $CSPEnabled = false;
+	public bool $CSPEnabled = false;	//TODO: Currently CSP3 tags are not supported so enabling this causes problems with script-src-elem, style-src-attr and style-src-elem
 
 	public function __construct()
 	{
diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php
index 2ac41a70d..b71d9ff78 100644
--- a/app/Config/ContentSecurityPolicy.php
+++ b/app/Config/ContentSecurityPolicy.php
@@ -47,28 +47,45 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var list<string>|string|null
      */
-    public $defaultSrc;
+    public $defaultSrc = [
+		'self',
+		'www.google.com',
+	];
 
     /**
      * Lists allowed scripts' URLs.
      *
      * @var list<string>|string
      */
-    public $scriptSrc = 'self';
+    public $scriptSrc = [
+		'self',
+		'unsafe-inline',
+		'unsafe-eval',
+		'www.google.com www.gstatic.com'
+	];
 
     /**
      * Lists allowed stylesheets' URLs.
      *
      * @var list<string>|string
      */
-    public $styleSrc = 'self';
+	public $styleSrc = [
+		'self',
+		'unsafe-inline',
+		'nonce-{csp-style-nonce}',
+		'https://fonts.googleapis.com',
+	];
 
-    /**
+	/**
      * Defines the origins from which images can be loaded.
      *
      * @var list<string>|string
      */
-    public $imageSrc = 'self';
+    public $imageSrc = [
+		'self',
+		'data:',
+		'blob:',
+	];
 
     /**
      * Restricts the URLs that can appear in a page's `<base>` element.
@@ -92,14 +109,21 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var list<string>|string
      */
-    public $connectSrc = 'self';
+    public $connectSrc = [
+		'self',
+		'nominatim.openstreetmap.org',
+	];
 
     /**
      * Specifies the origins that can serve web fonts.
      *
      * @var list<string>|string
      */
-    public $fontSrc;
+    public $fontSrc = [
+		'self',
+		'fonts.googleapis.com',
+		'fonts.gstatic.com',
+	];
 
     /**
      * Lists valid endpoints for submission from `<form>` tags.
@@ -138,14 +162,14 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * @var list<string>|string
      */
-    public $objectSrc = 'self';
+    public $objectSrc = 'none';
 
     /**
      * @var list<string>|string|null
      */
     public $manifestSrc;
 
-    /**
+     /**
      * Limits the kinds of plugins a page may invoke.
      *
      * @var list<string>|string|null
diff --git a/app/Controllers/Items.php b/app/Controllers/Items.php
index 6b61ae50c..60c252124 100644
--- a/app/Controllers/Items.php
+++ b/app/Controllers/Items.php
@@ -1120,7 +1120,9 @@ public function postImportCsvFile(): void
 					}
 
 					//Remove false, null, '' and empty strings but keep 0
-					$item_data = array_filter($item_data, 'strlen');
+					$item_data = array_filter($item_data, function($value) {
+						return $value !== null && strlen($value);
+					});
 
 					if(!$is_failed_row && $this->item->save_value($item_data, $item_id))
 					{
diff --git a/composer.json b/composer.json
index 624be7d6d..976f176b7 100644
--- a/composer.json
+++ b/composer.json
@@ -38,7 +38,6 @@
 		"laminas/laminas-escaper": "2.13.0",
 		"paragonie/random_compat": "^2.0.21",
 		"picqer/php-barcode-generator": "^2.4.0",
-		"psr/log": "3.0.0",
 		"tamtamchik/namecase": "^3.0.0"
 	},
 	"require-dev": {
@@ -53,6 +52,9 @@
 		"predis/predis": "^1.1||^2.0",
 		"roave/security-advisories": "dev-latest"
 	},
+	"replace": {
+		"psr/log": "*"
+	},
 	"autoload": {
 		"psr-4": {
 			"App\\":  "app/",
diff --git a/composer.lock b/composer.lock
index 9f0d07a87..4192a7521 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "48000f60a64f943cd782a03d365d0fd6",
+    "content-hash": "280d4425666ed2473d4cfd52f2804dfb",
     "packages": [
         {
             "name": "codeigniter4/framework",
@@ -563,56 +563,6 @@
             ],
             "time": "2023-09-16T08:58:52+00:00"
         },
-        {
-            "name": "psr/log",
-            "version": "3.0.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/php-fig/log.git",
-                "reference": "fe5ea303b0887d5caefd3d431c3e61ad47037001"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/php-fig/log/zipball/fe5ea303b0887d5caefd3d431c3e61ad47037001",
-                "reference": "fe5ea303b0887d5caefd3d431c3e61ad47037001",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=8.0.0"
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "3.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Psr\\Log\\": "src"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "PHP-FIG",
-                    "homepage": "https://www.php-fig.org/"
-                }
-            ],
-            "description": "Common interface for logging libraries",
-            "homepage": "https://github.com/php-fig/log",
-            "keywords": [
-                "log",
-                "psr",
-                "psr-3"
-            ],
-            "support": {
-                "source": "https://github.com/php-fig/log/tree/3.0.0"
-            },
-            "time": "2021-07-14T16:46:02+00:00"
-        },
         {
             "name": "sabberworm/php-css-parser",
             "version": "v8.5.1",
diff --git a/package-lock.json b/package-lock.json
index 06913a907..3fc7f9818 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
 				"bootstrap-datetime-picker": "2.4.4",
 				"bootstrap-notify": "^3.1.3",
 				"bootstrap-select": "^1.13.18",
-				"bootstrap-table": "^1.23.2",
+				"bootstrap-table": "^1.23.5",
 				"bootstrap-tagsinput-2021": "^0.8.6",
 				"bootstrap-toggle": "^2.2.2",
 				"bootstrap3-dialog": "github:nakupanda/bootstrap3-dialog#master",
@@ -1185,9 +1185,9 @@
 			}
 		},
 		"node_modules/bootstrap-table": {
-			"version": "1.23.2",
-			"resolved": "https://registry.npmjs.org/bootstrap-table/-/bootstrap-table-1.23.2.tgz",
-			"integrity": "sha512-1IFiWFZzbKlleXgYEHdwHkX6rxlQMEx2N1tA8rJK/j08pI+NjIGnxFeXUL26yQLQ0U135eis/BX3OV1+anY25g==",
+			"version": "1.23.5",
+			"resolved": "https://registry.npmjs.org/bootstrap-table/-/bootstrap-table-1.23.5.tgz",
+			"integrity": "sha512-9WByoSpJvA73gi2YYIlX6IWR74oZtBmSixul/Th8FTBtBd/kZRpbKESGTjhA3BA3AYTnfyY8Iy1KeRWPlV2GWQ==",
 			"license": "MIT",
 			"peerDependencies": {
 				"jquery": "3"
diff --git a/package.json b/package.json
index 7c52a944e..6915612ac 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
 		"bootstrap-datetime-picker": "2.4.4",
 		"bootstrap-notify": "^3.1.3",
 		"bootstrap-select": "^1.13.18",
-		"bootstrap-table": "^1.23.2",
+		"bootstrap-table": "^1.23.5",
 		"bootstrap-tagsinput-2021": "^0.8.6",
 		"bootstrap-toggle": "^2.2.2",
 		"bootstrap3-dialog": "github:nakupanda/bootstrap3-dialog#master",
diff --git a/public/.htaccess b/public/.htaccess
index 0068903e3..f9bfc285b 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -68,7 +68,7 @@ Options All -Indexes
 
 <IfModule mod_headers.c>
   Header always set X-Frame-Options "SAMEORIGIN"
-  Header add Content-Security-Policy "default-src 'self' www.google.com; connect-src 'self' nominatim.openstreetmap.org; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.google.com www.gstatic.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.googleapis.com fonts.gstatic.com; img-src 'self' data:; object-src 'none'; form-action 'self'"
+  Header add Content-Security-Policy "default-src 'self' www.google.com; connect-src 'self' nominatim.openstreetmap.org; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.google.com www.gstatic.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.googleapis.com fonts.gstatic.com; img-src 'self' data: blob:; object-src 'none'; form-action 'self'"
   Header set X-Content-Type-Options "nosniff"
   Header set X-XSS-Protection "1; mode=block"
   Header set X-Frame-Options "DENY"


Test patch: