Merge remote-tracking branch 'origin/develop'

app/Http/Controllers/Assets/AssetsController.php

@@ -66,7 +66,8 @@ class AssetsController extends Controller
     public function index(Request $request): View
     {
         $this->authorize('index', Asset::class);
-        $company = Company::find($request->input('company_id'));
+        $companyId = $request->input('company_id');
+        $company = is_scalar($companyId) ? Company::find($companyId) : null;
 
         return view('hardware/index')->with('company', $company);
     }

resources/views/hardware/index.blade.php

@@ -9,7 +9,7 @@
       $requestStatusTypeId = request()->input('status_id');
   @endphp
 
-  @if (($requestCompanyId) && ($company))
+  @if (is_scalar($requestCompanyId) && ($company instanceof \App\Models\Company))
     {{ $company->name }}
   @endif
 
@@ -40,7 +40,7 @@
 @endif
 {{ trans('general.assets') }}
 
-  @if (Request::has('order_number'))
+  @if (Request::has('order_number') && is_scalar($requestOrderNumber))
     : Order #{{ strval($requestOrderNumber) }}
   @endif
 @stop
@@ -56,10 +56,12 @@
     <x-container>
         <x-box name="assets">
             <x-table.assets :route="route('api.assets.index',
-                array('status_type' => e($requestStatusType),
-                'order_number'=>e(strval($requestOrderNumber)),
-                'company_id'=>e($requestCompanyId),
-                'status_id'=>e($requestStatusTypeId)))"/>
+                array(
+                    'status_type' => is_scalar($requestStatusType) ? $requestStatusType : null,
+                    'order_number' => is_scalar($requestOrderNumber) ? strval($requestOrderNumber) : null,
+                    'company_id' => is_scalar($requestCompanyId) ? $requestCompanyId : null,
+                    'status_id' => is_scalar($requestStatusTypeId) ? $requestStatusTypeId : null,
+                ))"/>
         </x-box>
     </x-container>
 @stop

resources/views/users/index.blade.php

@@ -31,13 +31,13 @@
         <x-box>
             <x-table.users :route="route('api.users.index',
                 [
-                    'status' => e(request('status')),
+                    'status' => is_scalar(request('status')) ? request('status') : null,
                     'deleted'=> (request('status')=='deleted') ? 'true' : 'false',
-                    'company_id' => e(request('company_id')),
-                    'manager_id' => e(request('manager_id')),
-                    'admins' => e(request('admins')),
-                    'superadmins' => e(request('superadmins')),
-                    'activated' => e(request('activated')),
+                    'company_id' => is_scalar(request('company_id')) ? request('company_id') : null,
+                    'manager_id' => is_scalar(request('manager_id')) ? request('manager_id') : null,
+                    'admins' => is_scalar(request('admins')) ? request('admins') : null,
+                    'superadmins' => is_scalar(request('superadmins')) ? request('superadmins') : null,
+                    'activated' => is_scalar(request('activated')) ? request('activated') : null,
                ])"/>
         </x-box>
     </x-container>

tests/Feature/Assets/Ui/AssetIndexTest.php

@@ -13,4 +13,16 @@ class AssetIndexTest extends TestCase
             ->get(route('hardware.index'))
             ->assertOk();
     }
+
+    public function test_page_renders_with_array_query_inputs()
+    {
+        $this->actingAs(User::factory()->superuser()->create())
+            ->get(route('hardware.index', [
+                'status_type' => ['Deleted'],
+                'order_number' => [123],
+                'company_id' => [1],
+                'status_id' => [1],
+            ]))
+            ->assertOk();
+    }
 }

tests/Feature/Users/Ui/IndexUsersTest.php

@@ -20,4 +20,15 @@ class IndexUsersTest extends TestCase
             ->get(route('users.index'))
             ->assertOk();
     }
+
+    public function test_page_renders_with_array_query_inputs()
+    {
+        $this->actingAs(User::factory()->viewUsers()->create())
+            ->get(route('users.index', [
+                'manager_id' => [1],
+                'company_id' => [1],
+                'status' => ['deleted'],
+            ]))
+            ->assertOk();
+    }
 }