vignesh/crmbackend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: sanitize filename in preview_document to prevent directory traversal
All checks were successful
Deploy Beta (NATIVE) / deploy (push) Successful in 22s
Details

Browse source
This commit is contained in:
vickytechkey 2026-08-16 19:56:53 +05:30
parent 4eb66f838d
commit 5146de116c
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
crm/views/seller_views.py
View file

@ -224,7 +224,7 @@ from rest_framework.permissions import AllowAny
@permission_classes([AllowAny]) @permission_classes([AllowAny])
@xframe_options_exempt @xframe_options_exempt
def preview_document(request): def preview_document(request):
filename = request.query_params.get('file', 'document.pdf') filename = request.query_params.get('file', 'document.pdf').lstrip('/')
# Dynamic S3 Presigned Redirect if AWS credentials are set # Dynamic S3 Presigned Redirect if AWS credentials are set
import os import os