Downloading Invoice doesnt work.

PhotonGeek

Current Database Version:
1.6.4

Current App Version:
5211ba73d5b39c265c111ffae23f1b5ff34cbdd9

Server Info

PHP version: 8.3.6
Database Version: 10.11.8-MariaDB-0ubuntu0.24.04.1 / 101108
Operating System: Linux itflow 6.9.3-060903-generic #202405300957 SMP PREEMPT_DYNAMIC Thu May 30 11:39:13 UTC 2024 x86_64
Web Server: Apache/2.4.58 (Ubuntu)
Apache/PHP Error Log: Debian/Ubuntu default is usually /var/log/apache2/error.log

Database Structure Check

Database stats

Number of tables: 98
Total number of fields: 952
Total number of rows: 166445
Current Database Version: 1.6.4

When I select download invoice nothing happens. I see the link is http://itflow.domain.com/invoice.php?invoice_id=3#

The error log doesnt show anything when i click on the Download Button.

Here is what i see in the error log when i login to ITFlow

[Mon Nov 04 10:45:03.984780 2024] [mpm_prefork:notice] [pid 821] AH00163: Apache/2.4.58 (Ubuntu) OpenSSL/3.0.13 configured -- resuming normal operations

[Mon Nov 04 10:45:03.984881 2024] [core:notice] [pid 821] AH00094: Command line: '/usr/sbin/apache2'

[Mon Nov 04 10:45:50.474848 2024] [php:warn] [pid 913] [client localIP:52031] PHP Warning: Undefined array key "last_visited" in /var/www/itflow.domain.local/login.php on line 224, referer: http://itflow.domain.local/login.php

Under a customer if I select export data that will download a PDF.

PhotonGeek

@wrongecho any suggestions on what could be causing the invoices not to download?

Bigbug

PhotonGeek there's a new debug page, paste yours in here

PhotonGeek

System Information

Operating SystemLinux itflow 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64Web ServerApache/2.4.62 (Ubuntu)Kernel Version6.11.0-9-genericDatabase Version11.4.3-MariaDB-1

PHP Extensions and Configuration

PHP Extensions

php-mailparse installedInstalled

php-imap installedInstalled

php-mysqli installedInstalled

php-intl installedInstalled

php-curl installedInstalled

php-mbstring installedInstalled

php-gd installedInstalled

PHP Configuration

shell_exec is enabledEnabled

upload_max_filesize >= 500M 500M

post_max_size >= 500M 500M

PHP Memory Limit >= 128M 128M

Max Execution Time >= 300 seconds 300 seconds

PHP version >= 8.2.08.3.11

Shell Commands

Command 'whois' available/usr/bin/whois

Command 'dig' available/usr/bin/dig

Command 'git' available/usr/bin/git

SSL Checks

Accessing via HTTPS Yes

SSL Certificate is valid Unable to retrieve certificate

Domain Checks

Site has a valid FQDNitflow.domain.local

File Permissions

Web user has write access to webroot directory/var/www/itflow.domain.local

Database Structure Comparison

No discrepancies found between the database and db.sql file.

Uploads Directory Stats

Number of files in uploads directory21Total size of uploads directory (MB)0.94 MB

Database Stats

Current Database Version 1.6.5

Total number of tables 99

Total number of fields 957

Total number of rows 159698

Total database size (MB)27.3 MB

All have Green Check Marks except SSL Certificate is Valid. I dont expose this externally yet.

johnny

Invoice PDF download utilized javascript so those wont show up on the server side. Could you copy and past any javascript errors from your browser.

Also does this affect all invoices?

PhotonGeek

I tried on mobile, and other computers same issue. It is also affected on all invoices.

Wierd thing is I can export client data to a pdf.

Under Chrome Developer i see this

Content Security Policy of your site blocks the use of 'eval' in JavaScript`
1. The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
  
  To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
  
  If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
  
  ⚠️ Allowing string evaluation comes at the risk of inline script injection.
2. Affected Resources
  1. 1 directive
    1. Source locationDirectiveStatusscript-srcblocked

I dont see any errors under the console tab.

PhotonGeek

johnny

I wonder if its your company logo do me a favor drop the company logo you used with ITFlow into the link below

Ill see if I can replicate

https://cloud.itflow.org/s/mWMPpdXyq5agy9X

PhotonGeek

it was the logo. I replaced it and it works.

johnny

Interesting I wonder what about your logo was causing it to behave like that. We would like to fix the underlying issue for others but we would need your logo uploaded so we can look into it further on our side

PhotonGeek

I replaced the logo and not sure which file i used. Can you tell me where the logo is stored so i can try to recover that file from a backup.

PhotonGeek

I uploaded the file let me know if you see it. I did notice it is a gif and if i use a JPG it works.

Bigbug

@johnny i think you should limit the logo formats to .png or .jpeg/.jpg

johnny

@Bigbug I agree ill get a patch pushed out