View | Details | Raw Unified | Return to bug 42080
Collapse All | Expand All

(-)a/acqui/invoice-files.pl (-5 / +27 lines)
Lines 28-33 Manage files associated with invoice Link Here
28
=cut
28
=cut
29
29
30
use Modern::Perl;
30
use Modern::Perl;
31
use File::LibMagic;
31
32
32
use CGI;
33
use CGI;
33
use C4::Auth        qw( get_template_and_user );
34
use C4::Auth        qw( get_template_and_user );
Lines 45-50 my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( Link Here
45
    }
46
    }
46
);
47
);
47
48
49
#NOTE: 'image/svg+xml' is not a safe type as the XML can contain Javascript
50
my $allowed_ftypes = {
51
    'application/pdf' => 1,
52
    'image/png'       => 1,
53
    'image/jpeg'      => 1,
54
    'image/gif'       => 1,
55
    'image/webp'      => 1,
56
};
57
48
my $invoiceid = $input->param('invoiceid') // '';
58
my $invoiceid = $input->param('invoiceid') // '';
49
my $op        = $input->param('op')        // '';
59
my $op        = $input->param('op')        // '';
50
my %errors;
60
my %errors;
Lines 58-68 if ( $op eq 'download' ) { Link Here
58
68
59
    my $fname = $file->{'file_name'};
69
    my $fname = $file->{'file_name'};
60
    my $ftype = $file->{'file_type'};
70
    my $ftype = $file->{'file_type'};
61
    print $input->header(
71
62
        -type                     => $file->{'file_type'},
72
    my $magic           = File::LibMagic->new();
63
        -charset                  => 'utf-8',
73
    my $magic_info      = $magic->info_from_string( $file->{'file_content'} );
64
        'Content-Security-Policy' => "default-src 'none'; script-src 'none';"
74
    my $magic_mime_type = $magic_info->{mime_type};
65
    );
75
    if ( $input->param('view') && ( $magic_mime_type && $allowed_ftypes->{$magic_mime_type} ) ) {
76
        print $input->header(
77
            -type                     => $file->{'file_type'},
78
            -charset                  => 'utf-8',
79
            'Content-Security-Policy' => "default-src 'none';"
80
        );
81
    } else {
82
        print $input->header(
83
            -type       => $file->{'file_type'},
84
            -charset    => 'utf-8',
85
            -attachment => $file->{'file_name'},
86
        );
87
    }
66
    print $file->{'file_content'};
88
    print $file->{'file_content'};
67
} else {
89
} else {
68
    my $details = GetInvoiceDetails($invoiceid);
90
    my $details = GetInvoiceDetails($invoiceid);
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt (-1 / +1 lines)
Lines 64-70 Link Here
64
                <tbody>
64
                <tbody>
65
                    [% FOREACH f IN files %]
65
                    [% FOREACH f IN files %]
66
                        <tr>
66
                        <tr>
67
                            <td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
67
                            <td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
68
                            <td>[% f.file_type | html %]</td>
68
                            <td>[% f.file_type | html %]</td>
69
                            <td>[% f.file_description | html %]</td>
69
                            <td>[% f.file_description | html %]</td>
70
                            <td data-order="[% f.date_uploaded | html %]"> [% f.date_uploaded | $KohaDates %] </td>
70
                            <td data-order="[% f.date_uploaded | html %]"> [% f.date_uploaded | $KohaDates %] </td>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt (-2 / +1 lines)
Lines 500-506 Link Here
500
                    [% FOREACH f IN files %]
500
                    [% FOREACH f IN files %]
501
                        <tr>
501
                        <tr>
502
                            <td>
502
                            <td>
503
                                <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a>
503
                                <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a>
504
                            </td>
504
                            </td>
505
                            <td>[% f.file_type | html %]</td>
505
                            <td>[% f.file_type | html %]</td>
506
                            <td>[% f.file_description | html %]</td>
506
                            <td>[% f.file_description | html %]</td>
507
- 

Return to bug 42080