darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 15:57:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

don't allow bad filetypes to preview

Browse Source
This commit is contained in:
Leo Hemsted
2017-04-12 12:12:11 +01:00
parent a0470b40ea
commit d655a38e14
4 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/main/views/send.py
View File

@@ -294,6 +294,9 @@ def check_messages(service_id, template_type, upload_id):
@login_required
@user_has_permissions('send_texts', 'send_emails', 'send_letters')
def check_messages_preview(service_id, template_type, upload_id, filetype):
if filetype not in ('pdf', 'png'):
abort(404)
template = _check_messages(
service_id, template_type, upload_id, letters_as_pdf=True
)['template']

3
app/main/views/templates.py
View File

@@ -88,6 +88,9 @@ def view_template(service_id, template_id):
@login_required
@user_has_permissions('view_activity', admin_override=True)
def view_letter_template_preview(service_id, template_id, filetype):
if filetype not in ('pdf', 'png'):
abort(404)
db_template = service_api_client.get_service_template(service_id, template_id)['data']
return TemplatePreview.from_database_object(db_template, filetype)