mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-06-16 03:19:34 -04:00
968d850b9d
- Disable isPhpEnabled in DOMPDF to prevent RCE via embedded PHP in HTML - Disable isRemoteEnabled to prevent SSRF attacks - Add email validation and sanitization in CSV import (FILTER_SANITIZE_EMAIL, FILTER_VALIDATE_EMAIL) - Reject invalid email formats during customer import
26 lines
669 B
PHP
26 lines
669 B
PHP
<?php
|
|
|
|
/**
|
|
* PDF helper
|
|
*/
|
|
function create_pdf(string $html, string $filename = ''): string
|
|
{
|
|
// Security: Disable PHP execution in PDFs to prevent RCE attacks
|
|
// Security: Disable remote file access to prevent SSRF attacks
|
|
// Only local files referenced in HTML are allowed
|
|
$dompdf = new Dompdf\Dompdf([
|
|
'isRemoteEnabled' => false,
|
|
'isPhpEnabled' => false
|
|
]);
|
|
$dompdf->loadHtml(str_replace(['\n', '\r'], '', $html));
|
|
$dompdf->render();
|
|
|
|
if ($filename != '') {
|
|
$dompdf->stream($filename . '.pdf');
|
|
} else { // TODO: Not all paths return a value.
|
|
return $dompdf->output();
|
|
}
|
|
|
|
return '';
|
|
}
|