gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 41591: Prevent inline rendering of invoice files 

This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
(cherry picked from commit 9ef05dfa7ec321a5bc7c84e0732d3d4ede945702)
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
This commit is contained in:
David Cook 2026-01-12 01:49:11 +00:00 committed by Baptiste Wojtkowski
parent ccc5cf627d
commit 7e33daa2c2
No known key found for this signature in database
GPG Key ID: 47A8A13E10BC0D40
2 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
acqui/invoice-files.pl
View File

@ -58,19 +58,11 @@ if ( $op eq 'download' ) {
my $fname = $file->{'file_name'};
my $ftype = $file->{'file_type'};
if ($input->param('view') && ($ftype =~ m|^image/|i || $fname =~ /\.pdf/i)) {
$fname =~ /\.pdf/i && do { $ftype='application/pdf'; };
print $input->header(
-type => $ftype,
-charset => 'utf-8'
);
} else {
print $input->header(
-type => $file->{'file_type'},
-charset => 'utf-8',
-attachment => $file->{'file_name'}
);
}
print $file->{'file_content'};
}
else {

2
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
View File

@ -69,7 +69,7 @@
<tbody>
[% FOREACH f IN files %]
<tr>
<td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
<td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
<td>[% f.file_type | html %]</td>
<td>[% f.file_description | html %]</td>
<td data-order="[% f.date_uploaded | html %]">