gitmedia/gruene-seele
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Warenwirtschaft: Review-Fix — AP-32-Label als Base64 übertragen (Connector 1.5.0)

Browse source 
Die Brücke hätte live nicht funktioniert: Connector 1.4.0 sendete die
label_url aus dem per 'deny from all' geschützten DHL-Ordner (403), dazu
SSRF-Risiko durch serverseitigen Abruf einer Client-URL und Timeout-
Mismatch (20 s Download vs. 5 s WordPress-Default). Der Connector liest
die PDF jetzt vom Shop-Dateisystem (realpath-Pinning auf wp-uploads) und
sendet sie Base64; storeWpLabel() validiert und speichert ohne Http::get;
tote Shop-Link-Fallbacks aus den Views entfernt; Connector-Timeout 30 s.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-20 10:06:39 +00:00
parent ddd6dde593
commit 1b9b6adc44
11 changed files with 173 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

7
resources/views/admin/inventory/orders/index.blade.php
View file

@ -185,15 +185,12 @@
@else
<span class="text-muted small">{{ __('extern') }}</span>
@endif
{{-- AP-32 Brückenlösung: DHL-Label aus dem Shop (lokale Kopie, sonst Shop-Link) --}}
{{-- AP-32 Brückenlösung: DHL-Label aus dem Shop (lokale Kopie; die Shop-URL
ist zugriffsgeschützt und wird bewusst nicht verlinkt, Review 20.07.2026) --}}
@if ($order->wp_label_path)
<a href="{{ route('admin.inventory.orders.document', [$order->id, 'label']) }}" target="_blank" title="{{ __('DHL-Label') }}" class="ml-1">
<span class="fas fa-tag"></span> {{ __('Label') }}
</a>
@elseif ($order->wp_label_url)
<a href="{{ $order->wp_label_url }}" target="_blank" rel="noopener" title="{{ __('DHL-Label (extern im Shop)') }}" class="ml-1">
<span class="fas fa-tag"></span> {{ __('Label') }}
</a>
@endif
@if ($order->tracking)
<div class="small text-muted" title="{{ __('Sendungsnummer') }}">{{ $order->tracking }}</div>

8
resources/views/admin/sales/_detail.blade.php
View file

@ -618,20 +618,18 @@
@if ($shopping_order->txaction === 'extern')
<div class="card-body">
@if ($shopping_order->wp_invoice_path || $shopping_order->wp_label_path || $shopping_order->wp_label_url)
@if ($shopping_order->wp_invoice_path || $shopping_order->wp_label_path || $shopping_order->tracking)
<div class="row">
<div class="col-sm-12">
@if ($shopping_order->wp_invoice_path)
<a href="{{ $shopping_order->wp_invoice_path }}" target="_blank"
class="btn btn-secondary btn-sm">Link zur Rechnung</a>
@endif
{{-- AP-32 Brückenlösung: DHL-Label aus dem WooCommerce-Shop --}}
{{-- AP-32 Brückenlösung: DHL-Label aus dem WooCommerce-Shop (lokale Kopie;
die Shop-URL ist zugriffsgeschützt und wird bewusst nicht verlinkt) --}}
@if ($shopping_order->wp_label_path)
<a href="{{ route('admin.inventory.orders.document', [$shopping_order->id, 'label']) }}" target="_blank"
class="btn btn-secondary btn-sm"><span class="fas fa-tag"></span> DHL-Label</a>
@elseif ($shopping_order->wp_label_url)
<a href="{{ $shopping_order->wp_label_url }}" target="_blank" rel="noopener"
class="btn btn-secondary btn-sm"><span class="fas fa-tag"></span> DHL-Label (Shop)</a>
@endif
@if ($shopping_order->tracking)
<span class="text-muted small ml-2">Sendungsnummer: {{ $shopping_order->tracking }}</span>