AdminGit2026/nis2-agile
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FEAT] #384 p.5 — allegati file su Policy (sezione Allegati nel dettaglio) + allowlist server-side upload evidenze

Browse Source 
- policies.html: sezione 'Allegati' nel dettaglio policy (Bootstrap Italia card),
  upload (entity_type=policy) via /api/audit/evidence/upload, lista con download/autore/data
- AuditController::uploadEvidence: allowlist estensioni server-side (anti stored-XSS same-origin)
- version.json -> 1.23.5

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
DevEnv nis2-agile
2026-06-18 19:00:01 +02:00
co-authored by Claude Opus 4.8
parent 6f3ca4b4bd
commit 8a8045904b
3 changed files with 109 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/controllers/AuditController.php
+8
View File
@@ -64,6 +64,14 @@ class AuditController extends BaseController
$this->jsonError('File troppo grande (max 10MB)', 400, 'FILE_TOO_LARGE');
}
// Allowlist estensioni (anti stored-XSS same-origin: niente html/svg/js eseguibili).
// Allineata a StakeholderPortalController::ALLOWED_EXT.
$allowedExt = ['pdf','png','jpg','jpeg','gif','webp','txt','csv','xlsx','xls','docx','doc','pptx','ppt','odt','ods','zip'];
$extCheck = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
if ($extCheck === '' || !in_array($extCheck, $allowedExt, true)) {
$this->jsonError('Tipo di file non consentito. Formati ammessi: PDF, immagini, documenti Office, txt, csv, zip.', 422, 'BAD_FILE_TYPE');
}
$orgId = $this->getCurrentOrgId();
$uploadDir = UPLOAD_PATH . "/evidence/{$orgId}";