[contract] Unvalidated orderBy(sort/direction) in controllers (SQL injection surface)

[HafizMMoaz]

Problem

Contract controllers sort by a column and direction taken directly from the query string, with no allow-list:

->when(request('sort'), fn($q) => $q->orderBy(request('sort'), request('direction', 'asc')))

Affected:

• src/Http/Controllers/ContractController.php
• src/Http/Controllers/ContractTypeController.php

Eloquent binds values but not identifiers, so an arbitrary sort value is interpolated into the SQL: a 500 on a bad column at best, an injection surface at worst. Mirrors the platform-wide issue tracked on zerp-pk/zerp.

Impact

Unhandled errors from arbitrary sort input and a SQL injection surface.

Suggested fix

Validate sort against a per-controller allow-list of sortable columns and direction against asc|desc before calling orderBy.