Bugzilla – Attachment 195246 Details for
Bug 42080
Invoice PDFs are forced downloads
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 42080: (follow-up) allow some file types, checked by libmagic, to be viewed inline
Bug-42080-follow-up-allow-some-file-types-checked-.patch (text/plain), 5.34 KB, created by
David Cook
on 2026-03-13 02:50:16 UTC
(
hide
)
Description:
Bug 42080: (follow-up) allow some file types, checked by libmagic, to be viewed inline
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-03-13 02:50:16 UTC
Size:
5.34 KB
patch
obsolete
>From 347e37b2e0fc6c3287b51a01be5cc318d4dfe384 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Fri, 13 Mar 2026 02:42:14 +0000 >Subject: [PATCH] Bug 42080: (follow-up) allow some file types, checked by > libmagic, to be viewed inline > >This patch uses File::LibMagic to determine the real file type using >libmagic and magic numbers of invoice files, and allows a select group >of file types to be viewed inline for user convenience. > >Note that a default Content-Security-Policy is still included to offer >an extra layer of protection against XSS. > >Test plan: >0a. Apply the patch >0b. koha-plack --restart kohadev >1. Enable the syspref AcqEnableFiles (ie set to Do) >2. Find or create an active vendor >3. Create a basket if one doesn't already exist >4. Receive a shipment for the vendor >5. Create an invoice >6. Click "Finish receiving" >7. Click "Manage invoice files" >8. Upload a range of files including SVG, PDF, PNG, TXT >9. Click on the "Download" button >10. Note that the file downloads for all types >11. Click on the link in the "Name" column >12. Note that only the PDF and PNG display inline in the browser. >The other file types should be downloaded same as if you clicked the >"Download" button. > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > acqui/invoice-files.pl | 32 ++++++++++++++++--- > .../prog/en/modules/acqui/invoice-files.tt | 2 +- > .../prog/en/modules/acqui/invoice.tt | 2 +- > 3 files changed, 29 insertions(+), 7 deletions(-) > >diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl >index 34b99f3b89a..6886642d853 100755 >--- a/acqui/invoice-files.pl >+++ b/acqui/invoice-files.pl >@@ -28,6 +28,7 @@ Manage files associated with invoice > =cut > > use Modern::Perl; >+use File::LibMagic; > > use CGI; > use C4::Auth qw( get_template_and_user ); >@@ -45,6 +46,15 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( > } > ); > >+#NOTE: 'image/svg+xml' is not a safe type as the XML can contain Javascript >+my $allowed_ftypes = { >+ 'application/pdf' => 1, >+ 'image/png' => 1, >+ 'image/jpeg' => 1, >+ 'image/gif' => 1, >+ 'image/webp' => 1, >+}; >+ > my $invoiceid = $input->param('invoiceid') // ''; > my $op = $input->param('op') // ''; > my %errors; >@@ -58,11 +68,23 @@ if ( $op eq 'download' ) { > > my $fname = $file->{'file_name'}; > my $ftype = $file->{'file_type'}; >- print $input->header( >- -type => $file->{'file_type'}, >- -charset => 'utf-8', >- 'Content-Security-Policy' => "default-src 'none'; script-src 'none';" >- ); >+ >+ my $magic = File::LibMagic->new(); >+ my $magic_info = $magic->info_from_string( $file->{'file_content'} ); >+ my $magic_mime_type = $magic_info->{mime_type}; >+ if ( $input->param('view') && ( $magic_mime_type && $allowed_ftypes->{$magic_mime_type} ) ) { >+ print $input->header( >+ -type => $file->{'file_type'}, >+ -charset => 'utf-8', >+ 'Content-Security-Policy' => "default-src 'none';" >+ ); >+ } else { >+ print $input->header( >+ -type => $file->{'file_type'}, >+ -charset => 'utf-8', >+ -attachment => $file->{'file_name'}, >+ ); >+ } > print $file->{'file_content'}; > } else { > my $details = GetInvoiceDetails($invoiceid); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >index 3507581aa0f..aeb50dbc9dd 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >@@ -64,7 +64,7 @@ > <tbody> > [% FOREACH f IN files %] > <tr> >- <td><a href="?invoiceid=[% invoiceid | uri %]&op=download&file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td> >+ <td><a href="?invoiceid=[% invoiceid | uri %]&op=download&view=1&file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td> > <td>[% f.file_type | html %]</td> > <td>[% f.file_description | html %]</td> > <td data-order="[% f.date_uploaded | html %]"> [% f.date_uploaded | $KohaDates %] </td> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >index a1feabc25ce..ae09cbc0a6f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >@@ -500,7 +500,7 @@ > [% FOREACH f IN files %] > <tr> > <td> >- <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | uri %]&op=download&file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a> >+ <a href="/cgi-bin/koha/acqui/invoice-files.pl?invoiceid=[% invoiceid | uri %]&op=download&view=1&file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a> > </td> > <td>[% f.file_type | html %]</td> > <td>[% f.file_description | html %]</td> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 42080
:
195226
|
195245
| 195246