CVE-2022-0514 (published 2022-03-21T19:15Z)

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/crater-invoice/crater
commit_details: repo_url: https://github.com/crater-invoice/crater
author: harshjagad20
author_date: 2022-03-04 12:08:03+05:30
msg: Fix tax per item issue & check currency key
repository: repo_url: https://github.com/crater-invoice/crater
repo_name: crater-invoice/crater
description: Open Source Invoicing Solution for Individuals & Businesses
repo_language: PHP
owner: crater-invoice
file_changes: filename: UpdateCompanySettingsController.php
change_type: ModificationType.MODIFY
diff: @@ -23,11 +23,13 @@ class UpdateCompanySettingsController extends Controller
         $companyCurrency = CompanySetting::getSetting('currency', $request->header('company'));
         $data = $request->settings;
 
-        if ($companyCurrency !== $data['currency'] && $company->hasTransactions()) {
-            return response()->json([
-                'success' => false,
-                'message' => 'Cannot update company currency after transactions are created.'
-            ]);
+        if (array_key_exists('currency', $data)) {
+            if ($companyCurrency !== $data['currency'] && $company->hasTransactions()) {
+                return response()->json([
+                    'success' => false,
+                    'message' => 'Cannot update company currency after transactions are created.'
+                ]);
+            }
         }
 
         CompanySetting::setSettings($data, $request->header('company'));

programming_language: PHP
filename: Invoice.php
change_type: ModificationType.MODIFY
diff: @@ -498,6 +498,10 @@ class Invoice extends Model implements HasMedia
             if (array_key_exists('taxes', $invoiceItem) && $invoiceItem['taxes']) {
                 foreach ($invoiceItem['taxes'] as $tax) {
                     $tax['company_id'] = $invoice->company_id;
+                    $tax['exchnage_rate'] = $invoice->exchange_rate;
+                    $tax['base_amount'] = $tax['amount'] * $exchange_rate;
+                    $tax['currency_id'] = $invoice->currency_id;
+
                     if (gettype($tax['amount']) !== "NULL") {
                         if (array_key_exists('recurring_invoice_id', $invoiceItem)) {
                             unset($invoiceItem['recurring_invoice_id']);

programming_language: PHP
filename: 2022_03_04_051438_calculate_base_values_for_invoice_items.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,38 @@
+<?php
+
+use Crater\Models\InvoiceItem;
+use Crater\Models\Tax;
+use Illuminate\Database\Migrations\Migration;
+
+class CalculateBaseValuesForInvoiceItems extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        $taxes = Tax::whereRelation('invoiceItem', 'base_amount', null)->get();
+
+        if ($taxes) {
+            $taxes->map(function ($tax) {
+                $invoiceItem = InvoiceItem::find($tax->invoice_item_id);
+                $exchange_rate = $invoiceItem->exchange_rate;
+                $tax->exchange_rate = $exchange_rate;
+                $tax->base_amount = $tax->amount * $exchange_rate;
+                $tax->save();
+            });
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        //
+    }
+}

programming_language: PHP