Daniel/webshop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: replace public PDF URLs with authenticated API route, private bucket
All checks were successful
Staging Build / build (push) Successful in 3m33s
Details

Browse Source
This commit is contained in:
DanielS
2026-07-04 17:43:33 +02:00
parent 28f2285a0e
commit 80abbfe566
5 changed files with 176 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
shop/lib/actions/orders.ts
View File

@@ -227,9 +227,8 @@ export async function submitOrder(params: {
if (uploadError) {
console.error('PDF Upload Error:', uploadError)
} else {
const { data: publicUrlData } = supabase.storage.from('invoices').getPublicUrl(fileName)
await supabase.from('orders').update({ pdf_url: publicUrlData.publicUrl }).eq('id', order.id)
order.pdf_url = publicUrlData.publicUrl
await supabase.from('orders').update({ pdf_url: fileName }).eq('id', order.id)
order.pdf_url = fileName
}
// 7. E-Mail mit PDF-Anhang an den Besteller senden
@@ -655,9 +654,8 @@ export async function updateOrder(
if (uploadError) {
console.error('PDF Upload Error:', uploadError)
} else {
const { data: publicUrlData } = supabase.storage.from('invoices').getPublicUrl(fileName)
await admin.from('orders').update({ pdf_url: publicUrlData.publicUrl }).eq('id', order.id)
order.pdf_url = publicUrlData.publicUrl
await admin.from('orders').update({ pdf_url: fileName }).eq('id', order.id)
order.pdf_url = fileName
}
// 4. E-Mail mit PDF-Anhang an den Besteller senden (Info über Änderung)