(ofbiz-framework) branch release24.09 updated: Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload

[mr...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 704c45d21d Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload
704c45d21d is described below

commit 704c45d21db7d53904ef014f88aaf2e2c692c85f
Author: Mridul Pathak <mr...@gmail.com>
AuthorDate: Sun Oct 18 11:02:13 2026 +0530

    Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload
    
    With the default allowZUGFeRDnotSecure=false, SecuredUpload.isValidPdfFile rejected every PDF carrying a single valid ZUGFeRD invoice, because the XML check compared document.toString() with "[#document: null]", which is what every parsed DOM document returns. It now rejects only when no XML document can be read.
---
 .../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 2bb6f65d28..0a67335bcd 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -991,7 +991,7 @@ public class SecuredUpload {
                     } else {
                         try {
                             Document document = UtilXml.readXmlDocument(importer.getUTF8());
-                            if (document.toString().equals("[#document: null]")) {
+                            if (document == null || document.getDocumentElement() == null) {
                                 safeState = false;
                                 Debug.logInfo("The file " + file.getAbsolutePath()
                                         + " is not a readable (valid and secure) PDF file. For security reason it's not accepted as a such file",