copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #219 from copenhagentruckwash/propose-fix-for-unauthenticated-pdf-access

Browse Source 
Fix unauthenticated PDF disclosure in file_server fallback
This commit is contained in:
Jeppe B
2026-06-01 23:12:00 +02:00
committed by GitHub
parent 0778776f00 cf370a8035
commit db80dad15f
1 changed files with 0 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/file_server.php
-14
View File
@@ -55,20 +55,6 @@ if ($isPDF && $isPDFStore) {
// Check if the certificate exists
if (!$wash_certificate_store->isFileInStore($file)) {
// Try the PDF store
$pdf_store = new \classes\pdf_store();
if ($pdf_store->isFileInStore(str_replace('/files/', '', $file))) {
// Download the certificate from the PDF store to /tmp
$certificate_path = $pdf_store->download(str_replace('/files/', '', $file));
// Send the certificate to the client
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . str_replace('/files/', '', $file) . '"');
header('Content-Length: ' . filesize($certificate_path));
readfile($certificate_path);
// Delete the certificate from /tmp after sending it
unlink($certificate_path);
exit;
}
echo 'Certificate not found in store' . $file;
//header('HTTP/1.1 404 Not Found');
exit;