06/05 Optimize app

app/routes/transactions.py

@@ -443,12 +443,21 @@ def ocr_receipt_file():
     from app.models.category import Category
     from flask import current_app
 
+    from app.models.receipt import Receipt
+
     data = request.get_json()
     if not data or not data.get('filename'):
         return jsonify({'error': 'No filename provided'}), 400
 
     # Security: only allow basenames, no path traversal
     filename = os.path.basename(data['filename'])
+
+    # Ownership check: filename must exist in receipts table (single-user, but
+    # prevents OCR extraction from arbitrary files on disk via a crafted request)
+    receipt_record = Receipt.query.filter_by(filename=filename).first()
+    if not receipt_record:
+        return jsonify({'error': 'Receipt not found'}), 404
+
     upload_dir = current_app.config.get('UPLOAD_FOLDER', '/home/pfm/app/uploads')
     file_path = os.path.join(upload_dir, filename)