From: Bernd Bleßmann <bernd@kivitendo-premium.de>
Date: Tue, 29 Sep 2015 11:47:31 +0000 (+0200)
Subject: Auftrags-Controller: PDF-Download: Dateiname als session_value speichern.
X-Git-Url: http://wagnertech.de/git?a=commitdiff_plain;h=d5b215deb52f9f8e4ba8380ac7df29cca7d6025b;p=kivitendo-erp.git

Auftrags-Controller: PDF-Download: Dateiname als session_value speichern.

Damit muss der Dateiname nicht mehr an den Client übertragen werden.
---

diff --git a/SL/Controller/Order.pm b/SL/Controller/Order.pm
index 1878cc7a2..3010b5bb9 100644
--- a/SL/Controller/Order.pm
+++ b/SL/Controller/Order.pm
@@ -120,21 +120,21 @@ sub action_create_pdf {
   $sfile->fh->print($pdf);
   $sfile->fh->close;
 
-  # get temporary session filename with stripped path
-  my (undef, undef, $tmp_filename) = File::Spec->splitpath($sfile->file_name);
+  my $key = join('_', Time::HiRes::gettimeofday(), int rand 1000000000000);
+  $::auth->set_session_value("Order::create_pdf-${key}" => $sfile->file_name);
+
   my $pdf_filename =  t8('Sales Order') . '_' . $self->order->ordnumber . '.pdf';
 
   $self->js
-    ->run('download_pdf', $tmp_filename, $pdf_filename)
+    ->run('download_pdf', $pdf_filename, $key)
     ->flash('info', t8('The PDF has been created'))->render($self);
 }
 
 sub action_download_pdf {
   my ($self) = @_;
 
-  # given tmp_filename should contain no path, so strip if any
-  my (undef, undef, $tmp_filename) = File::Spec->splitpath($::form->{tmp_filename});
-  my $tmp_filename = File::Spec->catfile(SL::SessionFile->new->get_path, $tmp_filename);
+  my $key = $::form->{key};
+  my $tmp_filename = $::auth->get_session_value("Order::create_pdf-${key}");
   return $self->send_file(
     $tmp_filename,
     type => 'application/pdf',
diff --git a/templates/webpages/order/form.html b/templates/webpages/order/form.html
index a1d90e172..31a4dc019 100644
--- a/templates/webpages/order/form.html
+++ b/templates/webpages/order/form.html
@@ -54,11 +54,11 @@ function create_pdf() {
   $.post("controller.pl", data, kivi.eval_json_result);
 }
 
-function download_pdf(tmp_filename, pdf_filename) {
+function download_pdf(pdf_filename, key) {
   var data = 'action=Order/download_pdf';
   data += '&type=' + $('#type').val();
-  data += '&tmp_filename=' + tmp_filename;
   data += '&pdf_filename=' + pdf_filename;
+  data += '&key=' + key;
   $.download("controller.pl", data);
 }