From 480d25217328843ce31208b4a055fe4a22717b17 Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Thu, 21 May 2026 14:19:17 +0100
Subject: [PATCH] Fixed RB-4158 - handle numeric values better

---
 app/Exceptions/Handler.php     | 7 +++++++
 app/Livewire/Importer.php      | 6 ++++++
 resources/assets/js/snipeit.js | 5 +++++
 3 files changed, 18 insertions(+)

diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php
index b895b62a52..aab74bfe0a 100644
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -19,6 +19,7 @@ use Illuminate\Validation\ValidationException;
 use Intervention\Image\Exception\NotSupportedException;
 use JsonException;
 use League\OAuth2\Server\Exception\OAuthServerException;
+use Livewire\Exceptions\PublicPropertyNotFoundException;
 use Symfony\Component\HttpKernel\Exception\HttpException;
 use Throwable;
 
@@ -41,6 +42,7 @@ class Handler extends ExceptionHandler
         JsonException::class,
         SCIMException::class, // these generally don't need to be reported
         InvalidFormatException::class,
+        PublicPropertyNotFoundException::class,
     ];
 
     /**
@@ -71,6 +73,11 @@ class Handler extends ExceptionHandler
     public function render($request, Throwable $e)
     {
 
+        // Livewire tried to set a property that doesn't exist (e.g. stale browser state sending a bare "0" as a property name)
+        if ($e instanceof PublicPropertyNotFoundException) {
+            return response()->json(['message' => $e->getMessage()], 422);
+        }
+
         // CSRF token mismatch error
         if ($e instanceof TokenMismatchException) {
             return redirect()->back()->with('error', trans('general.token_expired'));
diff --git a/app/Livewire/Importer.php b/app/Livewire/Importer.php
index 0c129ab34a..7eefdc87e4 100644
--- a/app/Livewire/Importer.php
+++ b/app/Livewire/Importer.php
@@ -720,6 +720,12 @@ class Importer extends Component
         $this->message_type = 'danger';
     }
 
+    public function process(): void
+    {
+        $this->message = trans('general.token_expired');
+        $this->message_type = 'danger';
+    }
+
     public function clearMessage()
     {
         $this->message = null;
diff --git a/resources/assets/js/snipeit.js b/resources/assets/js/snipeit.js
index bc14c6de1e..f8dfdd2f9b 100755
--- a/resources/assets/js/snipeit.js
+++ b/resources/assets/js/snipeit.js
@@ -618,6 +618,11 @@ document.addEventListener('livewire:init', () => {
             console.error("For data-livewire-component, you probably want to use $this->getId() or {{ $this->getId() }}, as appropriate")
             return false
         }
+        // PHP property names cannot start with a digit — skip bare numeric names (e.g. "0") that would cause a 500
+        if (/^\d+$/.test(event.target.name)) {
+            console.error("Livewire select2: name attribute '" + event.target.name + "' is not a valid Livewire property name — skipping")
+            return false
+        }
         Livewire.find(target.data('livewire-component')).set(event.target.name, this.options[this.selectedIndex].value)
     });