Improve invoice period data and POS add-on validation

services/nginx/app/classes/attachment_store.php

@@ -37,8 +37,21 @@ class attachment_store implements minio_uploads_i
      */
     public function isValidFilePath(string $filePath): bool
     {
-        // Check if the file path is valid
-        return preg_match('/^[a-zA-Z0-9_\-\/.]+$/', $filePath) === 1;
+        if (
+            $filePath === ''
+            || str_starts_with($filePath, '/')
+            || preg_match('/^[a-zA-Z0-9_\-\/.]+$/', $filePath) !== 1
+        ) {
+            return false;
+        }
+
+        foreach (explode('/', $filePath) as $segment) {
+            if ($segment === '' || $segment === '.' || $segment === '..') {
+                return false;
+            }
+        }
+
+        return true;
     }
 
     /**
@@ -82,7 +95,10 @@ class attachment_store implements minio_uploads_i
     {
         $host = 'https://api.truckwash.io';
 
+        $this->requireValidFilePath($fileName);
+        $encodedPath = implode('/', array_map('rawurlencode', explode('/', $fileName)));
+
         // Generate a direct download URL for the given file name
-        return $host . '/files/' . $fileName;
+        return $host . '/files/' . $encodedPath;
     }
-}
+}