From 5146de116c3dd2112a7729ea55ef37ddc04975ac Mon Sep 17 00:00:00 2001
From: vickytechkey <vichunice@gmail.com>
Date: Sun, 16 Aug 2026 19:56:53 +0530
Subject: [PATCH] fix: sanitize filename in preview_document to prevent
 directory traversal

---
 crm/views/seller_views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crm/views/seller_views.py b/crm/views/seller_views.py
index 50a2bbe..dd8b957 100644
--- a/crm/views/seller_views.py
+++ b/crm/views/seller_views.py
@@ -224,7 +224,7 @@ from rest_framework.permissions import AllowAny
 @permission_classes([AllowAny])
 @xframe_options_exempt
 def preview_document(request):
-    filename = request.query_params.get('file', 'document.pdf')
+    filename = request.query_params.get('file', 'document.pdf').lstrip('/')
     
     # Dynamic S3 Presigned Redirect if AWS credentials are set
     import os