inovice upload + related product in stock

openstore-ecommerce · Apr 20, 2021 · ce09324 · ce09324
1 parent 85b476d
commit ce09324
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 11 deletions.
diff --git a/Components/Orders/OrderFunctions.cs b/Components/Orders/OrderFunctions.cs
@@ -214,6 +214,14 @@ private static String OrderAdminSave(HttpContext context)
                             {
                                 var fname = Path.GetFileName(ajaxInfo.GetXmlProperty("genxml/hidden/optionfilelist"));
 
+                                var ext = Path.GetExtension(fname);
+                                fname = DnnUtils.Encrypt(fname, StoreSettings.Current.Get("adminpin"));
+                                foreach (char c in System.IO.Path.GetInvalidFileNameChars())
+                                {
+                                    fname = fname.Replace(c, '_');
+                                }
+                                fname = ext + "-" + fname; // add extension to front, so it cannot be servered but we can add to order data.
+
                                 if (File.Exists(StoreSettings.Current.FolderTempMapPath.TrimEnd('\\') + "\\" + fname))
                                 {
                                     var newfname = "secure" + Utils.GetUniqueKey();
@@ -229,9 +237,14 @@ private static String OrderAdminSave(HttpContext context)
                                     ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicefilepath", StoreSettings.Current.FolderUploadsMapPath.TrimEnd('\\') + "\\" + newfname);
                                     ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicefilename", newfname);
                                     ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoiceuploadname", fname);
-                                    ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicefileext", Path.GetExtension(fname));
+
+                                    var ext2 = "";
+                                    var extSplit = fname.Split('-');
+                                    if (extSplit.Count() > 0) ext2 = extSplit[0]; // we add the extension to the front of upload for IIS default security in serving file.
+
+                                    ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicefileext", ext2);
                                     ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicefilerelpath", StoreSettings.Current.FolderUploads + "/" + newfname);
-                                    ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicedownloadname", "NBS" + ordData.OrderNumber + Path.GetExtension(fname));
+                                    ordData.PurchaseInfo.SetXmlProperty("genxml/hidden/invoicedownloadname", "OS" + ordData.OrderNumber + ext2);
                                 }
                             }
 

diff --git a/Properties/AssemblyInfo.cs b/Properties/AssemblyInfo.cs
@@ -32,5 +32,5 @@
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("4.1.5.1")]
-[assembly: AssemblyFileVersion("4.1.5.1")]
+[assembly: AssemblyVersion("4.1.5.2")]
+[assembly: AssemblyFileVersion("4.1.5.2")]
diff --git a/Themes/ClassicAjax/Default/ProductDisplayDetail.cshtml b/Themes/ClassicAjax/Default/ProductDisplayDetail.cshtml
@@ -300,12 +300,12 @@ else
 
                                 <div class="price">
 
-                                    @if (product.Models.Count > 1)
+                                    @if (rproduct.Models.Count > 1)
                                     {
                                         <span class="from">@ResourceKey("ProductView.from")</span>
                                     }
 
-                                    @if (product.IsOnSale)
+                                    @if (rproduct.IsOnSale)
                                     {
                                         <span class="old">@(NBrightBuyUtils.FormatToStoreCurrency(rproduct.FromPrice()))</span>
                                         <span class="sale">@(NBrightBuyUtils.FormatToStoreCurrency(rproduct.BestPrice()))</span>
@@ -317,11 +317,11 @@ else
                                 </div>
 
                                 <div class="flags">
-                                @if (product.IsOnSale)
+                                @if (rproduct.IsOnSale)
                                 {
                                     <span class="onsaleflag">@ResourceKey("ProductView.onsaleflag")</span>
                                 }
-                                @if (!product.IsInStock)
+                                @if (!rproduct.IsInStock)
                                 {
                                     <span class="outofstockflag">@ResourceKey("ProductView.outofstockflag")</span>
                                 }

diff --git a/Themes/Default/Default/OrderAdminDetail.cshtml b/Themes/Default/Default/OrderAdminDetail.cshtml
@@ -26,7 +26,7 @@
 
         @if (nbi.GetXmlProperty("genxml/hidden/invoicefilename") != "")
         {
-            <a class="documentlink btn btn-default primarybutton" href='/DesktopModules/NBright/NBrightBuy/XmlConnector.ashx?cmd=docdownload&[email protected]("genxml/hidden/invoicedownloadname")&[email protected]("genxml/hidden/invoicefilerelpath")'>@ResourceKey("OrderAdmin.downloadinvoice")</a>
+            <a class="documentlink btn btn-default primarybutton" href='/DesktopModules/NBright/NBrightBuy/XmlConnector.ashx?cmd=docdownload&[email protected]("genxml/hidden/invoicedownloadname")&[email protected]&[email protected]("genxml/hidden/invoicefilerelpath")'>@ResourceKey("OrderAdmin.downloadinvoice")</a>
         }
     </div>
 

diff --git a/XmlConnector.ashx.cs b/XmlConnector.ashx.cs
@@ -287,13 +287,14 @@ private string DownloadSystemFile(string paramCmd, HttpContext context)
                 {
                     strOut = fname; // return this is error.
                     var downloadname = Utils.RequestQueryStringParam(context, "downloadname");
+                    var userid = Utils.RequestQueryStringParam(context, "userid");                    
                     var fpath = HttpContext.Current.Server.MapPath(fname);
                     if (downloadname == "") downloadname = Path.GetFileName(fname);
                     try
                     {
                         if (fpath.ToLower().Contains("\\secure"))
                         {
-                            if (NBrightBuyUtils.CheckManagerRights())
+                            if (NBrightBuyUtils.CheckManagerRights() || UserController.Instance.GetCurrentUserInfo().UserID.ToString() == userid)
                             {
                                 Utils.ForceDocDownload(fpath, downloadname, context.Response);
                             }
@@ -487,12 +488,14 @@ private String UploadWholeFile(HttpContext context, List<FilesStatus> statuses,
                 Regex fexpr = new Regex(StoreSettings.Current.Get("fileregexpr"));
                 if (fexpr.Match(file.FileName.ToLower()).Success)
                 {
+                    var ext = Path.GetExtension(file.FileName);
                     var fn = DnnUtils.Encrypt(file.FileName, StoreSettings.Current.Get("adminpin"));
                     foreach (char c in System.IO.Path.GetInvalidFileNameChars())
                     {
                         fn = fn.Replace(c, '_');
                     }
-                    file.SaveAs(StoreSettings.Current.FolderTempMapPath + "\\" + fn);
+                    fn = ext + "-" + fn; // add extension to front, so it cannot be servered but we can add to order data.
+                    file.SaveAs(StoreSettings.Current.FolderTempMapPath + "\\" + fn); 
                     statuses.Add(new FilesStatus(Path.GetFileName(fn), file.ContentLength));
                 }
             }