04/28 Fixed bugs

routes/payroll.py

@@ -117,11 +117,11 @@ def payroll_dashboard():
         employee_names = {}
         if working_hours_data:
             try:
-                # Use the same SQL approach as attendance report - JOIN with CAST
+                # Use parameterized IN clause to avoid SQL injection
                 employee_ids = list(working_hours_data['employees'].keys())
                 if employee_ids:
-                    # Build a query similar to attendance report
-                    placeholders = ','.join([f"'{emp_id}'" for emp_id in employee_ids])
+                    placeholders = ','.join([f':emp_{i}' for i in range(len(employee_ids))])
+                    emp_params = {f'emp_{i}': eid for i, eid in enumerate(employee_ids)}
                     employee_query = db.session.execute(text(f"""
                         SELECT 
                             ad.employee_id,
@@ -130,7 +130,7 @@ def payroll_dashboard():
                         LEFT JOIN employee e ON CAST(ad.employee_id AS UNSIGNED) = e.id
                         WHERE ad.employee_id IN ({placeholders})
                         GROUP BY ad.employee_id, e.firstName, e.lastName
-                    """))
+                    """), emp_params)
 
                     for row in employee_query:
                         if row[1]:  # Only add if we got a name
@@ -240,13 +240,13 @@ def export_payroll_excel():
 
         logger_handler.logger.info(f"Exporting {len(attendance_records)} attendance records to payroll Excel")
 
-        # Get employee names using the same method as dashboard
+        # Get employee names using parameterized IN clause to avoid SQL injection
         employee_names = {}
         try:
             employee_ids = list(set(str(record.employee_id) for record in attendance_records))
             if employee_ids:
-                # Use the same SQL approach as attendance report - JOIN with CAST
-                placeholders = ','.join([f"'{emp_id}'" for emp_id in employee_ids])
+                placeholders = ','.join([f':emp_{i}' for i in range(len(employee_ids))])
+                emp_params = {f'emp_{i}': eid for i, eid in enumerate(employee_ids)}
                 employee_query = db.session.execute(text(f"""
                     SELECT 
                         ad.employee_id,
@@ -255,7 +255,7 @@ def export_payroll_excel():
                     LEFT JOIN employee e ON CAST(ad.employee_id AS UNSIGNED) = e.id
                     WHERE ad.employee_id IN ({placeholders})
                     GROUP BY ad.employee_id, e.firstName, e.lastName
-                """))
+                """), emp_params)
 
                 for row in employee_query:
                     if row[1]:  # Only add if we got a name