FEAT #13729 TIME 0:10 Fix template path

src/app/contentManagement/controllers/JnlpController.php

@@ -215,6 +215,16 @@ class JnlpController
                 $extension = $explodeFile[count($explodeFile) - 1];
                 $newFileOnTmp = "tmp_file_{$GLOBALS['id']}_{$args['jnlpUniqueId']}.{$extension}";
 
+                $customId = CoreConfigModel::getCustomId();
+                if (!empty($customId) && is_dir("custom/{$customId}/modules/templates/templates/styles/")) {
+                    $stylesPath = "custom/{$customId}/modules/templates/templates/styles/";
+                } else {
+                    $stylesPath = 'modules/templates/templates/styles/';
+                }
+                if (strpos($queryParams['objectId'], $stylesPath) !== 0 || substr_count($queryParams['objectId'], '.') != 1) {
+                    return $response->withStatus(400)->withJson(['errors' => 'Template path is not valid']);
+                }
+
                 $pathToCopy = $queryParams['objectId'];
             } elseif ($queryParams['objectType'] == 'templateModification') {
                 $docserver = DocserverModel::getCurrentDocserver(['typeId' => 'TEMPLATES', 'collId' => 'templates', 'select' => ['path_template']]);

src/app/contentManagement/controllers/OnlyOfficeController.php

@@ -59,6 +59,16 @@ class OnlyOfficeController
         }
 
         if ($body['objectType'] == 'templateCreation') {
+            $customId = CoreConfigModel::getCustomId();
+            if (!empty($customId) && is_dir("custom/{$customId}/modules/templates/templates/styles/")) {
+                $stylesPath = "custom/{$customId}/modules/templates/templates/styles/";
+            } else {
+                $stylesPath = 'modules/templates/templates/styles/';
+            }
+            if (strpos($body['objectId'], $stylesPath) !== 0 || substr_count($body['objectId'], '.') != 1) {
+                return $response->withStatus(400)->withJson(['errors' => 'Template path is not valid']);
+            }
+
             $path = $body['objectId'];
             $fileContent = file_get_contents($path);
         } elseif ($body['objectType'] == 'templateModification') {

src/app/convert/controllers/ConvertPdfController.php

@@ -166,7 +166,9 @@ class ConvertPdfController
             return ['errors' => '[ConvertPdf]  Conversion failed ! '. implode(" ", $convertedFile['output'])];
         }
 
-        unlink("{$tmpPath}{$tmpFilename}");
+        if (is_file("{$tmpPath}{$tmpFilename}.{$aArgs['extension']}")) {
+            unlink("{$tmpPath}{$tmpFilename}.{$aArgs['extension']}");
+        }
 
         $resource = file_get_contents("{$tmpPath}{$tmpFilename}.pdf");