mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 14:25:21 +00:00
5839d8385d
Customer PDF controllers resolved the target document by raw mailable_id, ignoring mailable_type, and skipped the expiry check on the JSON endpoints. - Resolve via the $emailLog->mailable morph relation and assert the expected type (abort 404) so a token issued for one document type can't disclose another whose numeric id collides. - Enforce isExpired() (abort 403) on every public path, including the JSON getInvoice/getEstimate/getPayment endpoints. - Harden EmailLog::isExpired() to treat a null/unresolvable mailable as expired instead of throwing. Adds tests for cross-type 404, JSON-path expiry 403, and the valid path.
54 lines
1.7 KiB
PHP
54 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\V1\Customer;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Resources\EstimateResource;
|
|
use App\Mail\EstimateViewedMail;
|
|
use App\Models\CompanySetting;
|
|
use App\Models\Customer;
|
|
use App\Models\EmailLog;
|
|
use App\Models\Estimate;
|
|
use Illuminate\Http\Request;
|
|
|
|
class EstimatePdfController extends Controller
|
|
{
|
|
public function getPdf(EmailLog $emailLog, Request $request)
|
|
{
|
|
$estimate = $emailLog->mailable;
|
|
abort_unless($estimate instanceof Estimate, 404);
|
|
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
|
|
|
|
if ($estimate->status == Estimate::STATUS_SENT || $estimate->status == Estimate::STATUS_DRAFT) {
|
|
$estimate->status = Estimate::STATUS_VIEWED;
|
|
$estimate->save();
|
|
$notifyEstimateViewed = CompanySetting::getSetting(
|
|
'notify_estimate_viewed',
|
|
$estimate->company_id
|
|
);
|
|
|
|
if ($notifyEstimateViewed == 'YES') {
|
|
$data['estimate'] = Estimate::findOrFail($estimate->id)->toArray();
|
|
$data['user'] = Customer::find($estimate->customer_id)->toArray();
|
|
$notificationEmail = CompanySetting::getSetting(
|
|
'notification_email',
|
|
$estimate->company_id
|
|
);
|
|
|
|
\Mail::to($notificationEmail)->send(new EstimateViewedMail($data));
|
|
}
|
|
}
|
|
|
|
return $estimate->getGeneratedPDFOrStream('estimate');
|
|
}
|
|
|
|
public function getEstimate(EmailLog $emailLog)
|
|
{
|
|
$estimate = $emailLog->mailable;
|
|
abort_unless($estimate instanceof Estimate, 404);
|
|
abort_if($emailLog->isExpired(), 403, 'Link Expired.');
|
|
|
|
return new EstimateResource($estimate);
|
|
}
|
|
}
|