(ofbiz-framework) branch release24.09 updated: Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 704c45d21d Fixed: PDF files with a ZUGFeRD invoice are always rejected 
on upload
704c45d21d is described below

commit 704c45d21db7d53904ef014f88aaf2e2c692c85f
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Oct 18 11:02:13 2026 +0530

    Fixed: PDF files with a ZUGFeRD invoice are always rejected on upload
    
    With the default allowZUGFeRDnotSecure=false, SecuredUpload.isValidPdfFile 
rejected every PDF carrying a single valid ZUGFeRD invoice, because the XML 
check compared document.toString() with "[#document: null]", which is what 
every parsed DOM document returns. It now rejects only when no XML document can 
be read.
---
 .../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 2bb6f65d28..0a67335bcd 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -991,7 +991,7 @@ public class SecuredUpload {
                     } else {
                         try {
                             Document document = 
UtilXml.readXmlDocument(importer.getUTF8());
-                            if (document.toString().equals("[#document: 
null]")) {
+                            if (document == null || 
document.getDocumentElement() == null) {
                                 safeState = false;
                                 Debug.logInfo("The file " + 
file.getAbsolutePath()
                                         + " is not a readable (valid and 
secure) PDF file. For security reason it's not accepted as a such file",