fix: sanitize filename in preview_document to prevent directory traversal

crm/views/seller_views.py

@@ -224,7 +224,7 @@ from rest_framework.permissions import AllowAny
 @permission_classes([AllowAny])
 @xframe_options_exempt
 def preview_document(request):
-    filename = request.query_params.get('file', 'document.pdf')
+    filename = request.query_params.get('file', 'document.pdf').lstrip('/')
     
     # Dynamic S3 Presigned Redirect if AWS credentials are set
     import os