@hmcts/ccd-case-ui-toolkit 7.4.10-glob-cve → 7.4.11-broken-access
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -14794,7 +14794,7 @@ class CaseFileViewFieldComponent {
|
|
|
14794
14794
|
}
|
|
14795
14795
|
setMediaViewerFile(document) {
|
|
14796
14796
|
const documentDetails = {
|
|
14797
|
-
document_binary_url: document
|
|
14797
|
+
document_binary_url: this.withLegacyDocumentAccessContext(this.documentManagementService.getDocumentBinaryUrl(document)),
|
|
14798
14798
|
document_filename: document.document_filename,
|
|
14799
14799
|
content_type: document.content_type
|
|
14800
14800
|
};
|
|
@@ -14809,6 +14809,19 @@ class CaseFileViewFieldComponent {
|
|
|
14809
14809
|
const mediaViewerInfo = this.documentManagementService.getMediaViewerInfo(documentDetails);
|
|
14810
14810
|
this.currentDocument = JSON.parse(mediaViewerInfo);
|
|
14811
14811
|
}
|
|
14812
|
+
withLegacyDocumentAccessContext(documentBinaryUrl) {
|
|
14813
|
+
if (!documentBinaryUrl || !this.caseId) {
|
|
14814
|
+
return documentBinaryUrl;
|
|
14815
|
+
}
|
|
14816
|
+
const [path, query = ''] = documentBinaryUrl.split('?');
|
|
14817
|
+
if (!/^\/documents\/[^/]+\/binary\/?$/.test(path)) {
|
|
14818
|
+
return documentBinaryUrl;
|
|
14819
|
+
}
|
|
14820
|
+
// XUI validates legacy document access against the case before proxying the binary request.
|
|
14821
|
+
const searchParams = new URLSearchParams(query);
|
|
14822
|
+
searchParams.set('caseId', this.caseId);
|
|
14823
|
+
return `${path}?${searchParams.toString()}`;
|
|
14824
|
+
}
|
|
14812
14825
|
moveDocument(data) {
|
|
14813
14826
|
const cid = this.route.snapshot.paramMap.get(CaseFileViewFieldComponent.PARAM_CASE_ID);
|
|
14814
14827
|
const loadingToken = this.loadingService.register();
|