From 3fa159ff2aaa2a58bcc7c112a276927860ea940e Mon Sep 17 00:00:00 2001
From: Samir Boulahtit <samir.boulahtit@wizard.lu>
Date: Sun, 26 Apr 2026 17:58:42 +0200
Subject: [PATCH] fix(loyalty): sanitize earn amount input on every keystroke

Switch from type=number (leaks special chars via compose keys) to
type=text with @input sanitizer that strips non-digit/non-dot
characters and prevents multiple dots. Handles accented characters,
paste, and compose key sequences.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 app/modules/loyalty/templates/loyalty/store/terminal.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/modules/loyalty/templates/loyalty/store/terminal.html b/app/modules/loyalty/templates/loyalty/store/terminal.html
index 346286d2..c17f6b2f 100644
--- a/app/modules/loyalty/templates/loyalty/store/terminal.html
+++ b/app/modules/loyalty/templates/loyalty/store/terminal.html
@@ -212,9 +212,9 @@
                                 <label class="block text-xs text-gray-500 dark:text-gray-400 mb-1">{{ _('loyalty.store.terminal.purchase_amount') }}</label>
                                 <div class="relative">
                                     <span class="absolute inset-y-0 left-0 flex items-center pl-3 text-gray-500">EUR</span>
-                                    <input type="number" step="0.01" min="0" inputmode="decimal" {# noqa: FE-008 #}
-                                           x-model.number="earnAmount"
-                                           @keypress="if (!/[\d.]/.test($event.key) && $event.key !== 'Backspace' && $event.key !== 'Tab') $event.preventDefault()"
+                                    <input type="text" inputmode="decimal" {# noqa: FE-008 #}
+                                           x-model="earnAmount"
+                                           @input="earnAmount = $event.target.value.replace(/[^\d.]/g, '').replace(/(\..*)\./g, '$1')"
                                            class="w-full pl-12 pr-4 py-2 text-sm border border-gray-300 dark:border-gray-600 rounded-lg focus:border-green-400 focus:outline-none dark:bg-gray-700 dark:text-gray-300">
                                 </div>
                             </div>