mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-09-06 15:14:13 +00:00
Darko Gjorgjijoski
4d6ece6230
Backport of InvoiceShelf/InvoiceShelf#691 to 2.x, for the reporter of #688 who is on 2.4.1. The guard added in the 2.4.0 security round rejects private addresses, which includes the shipped default host `http://pdf:3000` and every Docker Compose sidecar deployment. So the guard rejects its own default and Gotenberg cannot be configured at all on the standard setup — a usability regression introduced by a security patch, which is why this lands during the 2.x feature freeze. GOTENBERG_ALLOWED_PRIVATE_HOST names the single host that may skip the check. It is deliberately not a boolean and not settable from the admin UI: the driver streams the upstream response body back as the PDF, so a blanket "allow private" switch would let gotenberg_host be repointed at a link-local metadata endpoint and the response read back. Naming one host keeps the sidecar working while every other private target stays blocked. GotenbergHostPolicy owns the comparison so the save-time rule and the runtime driver guard cannot drift, normalising case, trailing slash and surrounding whitespace on both sides. Note this differs from 3.x in one respect: SafeRemoteUrl rejects hosts that do not resolve, where 3.x's PrivateNetworkGuard lets them through. That behaviour is unchanged here — a typo'd host is still refused at save time on 2.x, which is the friendlier outcome.
77 lines
2.3 KiB
PHP
77 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Requests;
|
|
|
|
use App\Rules\SafeRemoteUrl;
|
|
use App\Support\GotenbergHostPolicy;
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
use Illuminate\Validation\Rule;
|
|
|
|
class PDFConfigurationRequest extends FormRequest
|
|
{
|
|
/**
|
|
* Determine if the user is authorized to make this request.
|
|
*/
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Get the validation rules that apply to the request.
|
|
*/
|
|
public function rules(): array
|
|
{
|
|
switch ($this->get('pdf_driver')) {
|
|
case 'dompdf':
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
];
|
|
|
|
case 'gotenberg':
|
|
// The operator-declared Gotenberg host skips the public-address
|
|
// check; anything else is still held to it. See GotenbergHostPolicy.
|
|
$isDeclaredHost = GotenbergHostPolicy::isExemptFromSafeRemoteUrl(
|
|
$this->input('gotenberg_host')
|
|
);
|
|
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
'gotenberg_host' => [
|
|
'required',
|
|
'url',
|
|
Rule::when(! $isDeclaredHost, [new SafeRemoteUrl]),
|
|
],
|
|
'gotenberg_papersize' => [
|
|
'required',
|
|
'string',
|
|
function ($attribute, $value, $fail) {
|
|
$reg = "/^\d+(pt|px|pc|mm|cm|in) \d+(pt|px|pc|mm|cm|in)$/";
|
|
if (! preg_match($reg, $value)) {
|
|
$fail('Invalid papersize, must be in format "210mm 297mm". Accepts: pt,px,pc,mm,cm,in');
|
|
}
|
|
},
|
|
],
|
|
'gotenberg_margins' => [
|
|
'nullable',
|
|
'string',
|
|
],
|
|
];
|
|
|
|
default:
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
];
|
|
}
|
|
}
|
|
}
|