|
Lines 28-33
Manage files associated with invoice
Link Here
|
| 28 |
=cut |
28 |
=cut |
| 29 |
|
29 |
|
| 30 |
use Modern::Perl; |
30 |
use Modern::Perl; |
|
|
31 |
use File::LibMagic; |
| 31 |
|
32 |
|
| 32 |
use CGI; |
33 |
use CGI; |
| 33 |
use C4::Auth qw( get_template_and_user ); |
34 |
use C4::Auth qw( get_template_and_user ); |
|
Lines 45-50
my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user(
Link Here
|
| 45 |
} |
46 |
} |
| 46 |
); |
47 |
); |
| 47 |
|
48 |
|
|
|
49 |
#NOTE: 'image/svg+xml' is not a safe type as the XML can contain Javascript |
| 50 |
my $allowed_ftypes = { |
| 51 |
'application/pdf' => 1, |
| 52 |
'image/png' => 1, |
| 53 |
'image/jpeg' => 1, |
| 54 |
'image/gif' => 1, |
| 55 |
'image/webp' => 1, |
| 56 |
}; |
| 57 |
|
| 48 |
my $invoiceid = $input->param('invoiceid') // ''; |
58 |
my $invoiceid = $input->param('invoiceid') // ''; |
| 49 |
my $op = $input->param('op') // ''; |
59 |
my $op = $input->param('op') // ''; |
| 50 |
my %errors; |
60 |
my %errors; |
|
Lines 58-68
if ( $op eq 'download' ) {
Link Here
|
| 58 |
|
68 |
|
| 59 |
my $fname = $file->{'file_name'}; |
69 |
my $fname = $file->{'file_name'}; |
| 60 |
my $ftype = $file->{'file_type'}; |
70 |
my $ftype = $file->{'file_type'}; |
| 61 |
print $input->header( |
71 |
|
| 62 |
-type => $file->{'file_type'}, |
72 |
my $magic = File::LibMagic->new(); |
| 63 |
-charset => 'utf-8', |
73 |
my $magic_info = $magic->info_from_string( $file->{'file_content'} ); |
| 64 |
'Content-Security-Policy' => "default-src 'none'; script-src 'none';" |
74 |
my $magic_mime_type = $magic_info->{mime_type}; |
| 65 |
); |
75 |
if ( $input->param('view') && ( $magic_mime_type && $allowed_ftypes->{$magic_mime_type} ) ) { |
|
|
76 |
print $input->header( |
| 77 |
-type => $file->{'file_type'}, |
| 78 |
-charset => 'utf-8', |
| 79 |
'Content-Security-Policy' => "default-src 'none';" |
| 80 |
); |
| 81 |
} else { |
| 82 |
print $input->header( |
| 83 |
-type => $file->{'file_type'}, |
| 84 |
-charset => 'utf-8', |
| 85 |
-attachment => $file->{'file_name'}, |
| 86 |
); |
| 87 |
} |
| 66 |
print $file->{'file_content'}; |
88 |
print $file->{'file_content'}; |
| 67 |
} else { |
89 |
} else { |
| 68 |
my $details = GetInvoiceDetails($invoiceid); |
90 |
my $details = GetInvoiceDetails($invoiceid); |