func (VS *Server) showPDF(c *gin.Context) {
	pathToPDF := basePath + "/local-resources/pdf/qr/"
	fileName, b := VS.getParamFromURL(c, "name")
	if !b {
		return
	}
	targetPath := filepath.Join(pathToPDF, fileName)
	// This check is for example, I not sure is it can prevent all possible filename attacks - will be much better if real filename will not come from user side. I not even tryed this code
	if !strings.HasPrefix(filepath.Clean(targetPath), pathToPDF) {
		c.String(403, "Look like you attacking me")
		return
	}
	// Seems this headers needed for some browsers (for example without this headers Chrome will download files as txt)
	c.Header("Content-Description", "File Transfer")
	c.Header("Content-Transfer-Encoding", "binary")
	// Add this two headers to download instead of see in browser
	// c.Header("Content-Disposition", "attachment; filename="+fileName )
	// c.Header("Content-Type", "application/octet-stream")
	c.File(targetPath)
}
// Shows the PDF in the browser
Shows the PDF in the browser
// Shows the PDF in the browser
func (VS *Server) showPDF(c *gin.Context) {
	pathToPDF := basePath + "/local-resources/pdf/qr/"
	fileName, b := VS.getParamFromURL(c, "name")
	if !b {
		return
	}
	targetPath := filepath.Join(pathToPDF, fileName)
	if !strings.HasPrefix(filepath.Clean(targetPath), pathToPDF) {
		c.String(403, "Look like you attacking me")
		return
	}
	c.Header("Content-Description", "File Transfer")
	c.Header("Content-Transfer-Encoding", "binary")
	c.File(targetPath)
}
func ( VS * Server ) showPDF ( c * gin . Context ) { pathToPDF := basePath + " " fileName , b := VS . getParamFromURL ( c , " " ) if ! b { return } targetPath := filepath . Join ( pathToPDF , fileName ) if ! strings . HasPrefix ( filepath . Clean ( targetPath ) , pathToPDF ) { c . String ( 403 , " " ) return } c . Header ( " " , " " ) c . Header ( " " , " " ) c . File ( targetPath ) }
Shows the PDF in the browser
Shows the PDF in the browser
// This check is for example, I not sure is it can prevent all possible filename attacks - will be much better if real filename will not come from user side. I not even tryed this code // Seems this headers needed for some browsers (for example without this headers Chrome will download files as txt) // Add this two headers to download instead of see in browser // c.Header("Content-Disposition", "attachment; filename="+fileName ) // c.Header("Content-Type", "application/octet-stream")