Every PR, checked against the ticket that asked for it.

Partial refunds from the order page

Requirements · 3 of 4 met

• Refund any amount up to the captured total
• Record the refund reason on the order
• Email the customer a refund receipt
• Block refunds on orders older than 180 daysopen

Finding · SQL injection · RefundRepository.php

- $rows = $db->query($sql . $id);
+ $stmt = $db->prepare($sql . '?');
+ $stmt->execute([$id]);