Skip to content

Fix critical sales and log integrity bugs - #83

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-investigation-d3ab
Draft

Fix critical sales and log integrity bugs#83
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-investigation-d3ab

Conversation

@cursor

@cursor cursor Bot commented Jul 4, 2026

Copy link
Copy Markdown

Bug and impact

  • Sale detail GET rewrote persisted sale totals from line items, corrupting completed/historical sales amounts and reports.
  • Checkout exposed/accepted unsupported credit and one-step mixed payments, allowing completed sales without receivables or balance settlement.
  • Draft sale item deletion was a GET side effect and non-atomic, allowing accidental/CSRF-triggered stock restoration and item deletion.
  • Log file download/delete audit entries used content_type_id=0, causing FK failures after file operations.

Root cause

  • Read-only and destructive sales routes lacked method/transaction boundaries and payment-method validation.
  • Log file audit records used an invalid content type instead of nullable admin log content types.

Fix

  • Made sale detail read-only, removed invalid amount fallback, normalized/validated payment methods, and replaced the unsupported credit button with other.
  • Restricted sale item deletion to POST with CSRF template form and row locks.
  • Changed log file audit entries to nullable content types and added missing delete confirmation template.

Validation

  • mkdir -p /workspace/logs && .venv/bin/python manage.py test inventory.tests.test_sale_status inventory.tests.test_sales_balance_payment inventory.tests.test_views.LogFileViewTest (17 tests OK)
  • .venv/bin/python manage.py check (only existing staticfiles.W004 warning)
Open in Web View Automation 

Co-authored-by: Xianist Lab <zhtyyx@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant