diff --git a/imgsrv/lib/SRV/Utils.pm b/imgsrv/lib/SRV/Utils.pm index fece35cce..8259e0071 100644 --- a/imgsrv/lib/SRV/Utils.pm +++ b/imgsrv/lib/SRV/Utils.pm @@ -503,9 +503,14 @@ sub parse_env { } else { $value = join(',', @values); } - if ( ( $param eq 'seq' || $param eq 'seq[]' ) && ( $values[0] =~ m,^\d+$, || $values[0] =~ m{^\d+,\d+} || $values[0] =~ m{^\d+\-\d+} ) ) { - $value = "seq:" . join(',', sort { int($a) <=> int($b) } @values); + if ( $param eq 'seq' || $param eq 'seq[]' ) { + if ( $values[0] =~ m,^\d+$, || $values[0] =~ m{^\d+,\d+} || $values[0] =~ m{^\d+\-\d+} ) { + $value = "seq:" . join(',', sort { int($a) <=> int($b) } @values); $key = 'file'; + } else { + # Not a valid seq, remove it + next; + } } $$params{$key} = $value; } diff --git a/pt/web/firebird/tests/imgsrv_download.spec.js b/pt/web/firebird/tests/imgsrv_download.spec.js index 9e5e2c8c6..c6835a568 100644 --- a/pt/web/firebird/tests/imgsrv_download.spec.js +++ b/pt/web/firebird/tests/imgsrv_download.spec.js @@ -146,4 +146,11 @@ test.describe('imgsrv download', () => { expect(downloadHeaders['content-type']).toEqual('image/jpeg'); expect(downloadBody.length).toBeGreaterThan(1); }); + + test('download pdf with bogus seq', async ({ request, page }) => { + const initialResponse = await request.get( + 'http://apache:8080/cgi/imgsrv/download/pdf?id=test.pd_open&attachment=1&tracker=D1&seq=mashed_potatoes' + ); + expect(initialResponse.status()).toEqual(200); + }); });