From b6ec792aa578266da9ff0ea7b006b21b6a5d6dbd Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Mon, 12 Jan 2026 01:49:11 +0000
Subject: [PATCH] Bug 41591: Prevent inline rendering of invoice files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch forces download of invoice files rather than showing
them inline where they can potentially perform XSS

Test plan:
0. Apply the patch
1. koha-plack --restart kohadev
2. Find or create an active vendor
3. Create a basket if one doesn't already exist
4. Receive a shipment for the vendor
5. Create an invoice
6. Go to the invoice
7. In the URL change invoice.pl to invoice-files.pl
(or turn on AcqEnableFiles and go to it that way)
8. Upload an image file (e.g. SVG) or PDF
9. Click on the filename
10. Note that instead of displaying in the browser,
the file will be downloaded

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Chloé Zermatten <chloe.zermatten@openfifth.co.uk>
---
 acqui/invoice-files.pl                         | 18 +++++-------------
 .../prog/en/modules/acqui/invoice-files.tt     |  2 +-
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl
index f79d0d6569..39ab34d51e 100755
--- a/acqui/invoice-files.pl
+++ b/acqui/invoice-files.pl
@@ -58,19 +58,11 @@ if ( $op eq 'download' ) {
 
     my $fname = $file->{'file_name'};
     my $ftype = $file->{'file_type'};
-    if ( $input->param('view') && ( $ftype =~ m|^image/|i || $fname =~ /\.pdf/i ) ) {
-        $fname =~ /\.pdf/i && do { $ftype = 'application/pdf'; };
-        print $input->header(
-            -type    => $ftype,
-            -charset => 'utf-8'
-        );
-    } else {
-        print $input->header(
-            -type       => $file->{'file_type'},
-            -charset    => 'utf-8',
-            -attachment => $file->{'file_name'}
-        );
-    }
+    print $input->header(
+        -type       => $file->{'file_type'},
+        -charset    => 'utf-8',
+        -attachment => $file->{'file_name'}
+    );
     print $file->{'file_content'};
 } else {
     my $details = GetInvoiceDetails($invoiceid);
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
index aeb50dbc9d..3507581aa0 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt
@@ -64,7 +64,7 @@
                 <tbody>
                     [% FOREACH f IN files %]
                         <tr>
-                            <td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;view=1&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
+                            <td><a href="?invoiceid=[% invoiceid | uri %]&amp;op=download&amp;file_id=[% f.file_id | uri %]">[% f.file_name | html %]</a></td>
                             <td>[% f.file_type | html %]</td>
                             <td>[% f.file_description | html %]</td>
                             <td data-order="[% f.date_uploaded | html %]"> [% f.date_uploaded | $KohaDates %] </td>