06/01 Review and optimize on UI/UX, security, and functionality

2026-06-01 15:33:28 -04:00
parent 3d0ebc92c6
commit 8ca54827b2
6 changed files with 258 additions and 137 deletions
@@ -398,4 +398,5 @@ def delete_receipt(txn_id):
@login_required
 def view_receipt(filename):
    upload_dir = current_app.config.get('UPLOAD_FOLDER', '/home/pfm/app/uploads')
-    return send_from_directory(upload_dir, filename)
+    # Strip any path components to prevent directory traversal
+    return send_from_directory(upload_dir, os.path.basename(filename))