Skip to content

PDF-Editor 0.6.0

Choose a tag to compare

View all tags
@presire presire released this 29 Apr 20:41
· 1 commit to master since this release
v0.6.0
7a43d1f

Version 0.6.0 - Add server-side PDF assembly with qpdf and CSP nonce support

Introduce assemble-pdf.php endpoint that assembles PDF pages server-side using qpdf,
with full security hardening (same-origin check, CSRF token, rate limiting,
PDF magic byte validation, and command injection prevention).

Refactor downloadPDF to attempt server-side assembly first via qpdf,
falling back to client-side pdf-lib when unavailable.
Extract pdf-lib logic into assemblePDFWithPdfLib for clarity.

Add automatic owner-password encryption detection during PDF loading:
if pdf.js can open a file but pdf-lib rejects it as encrypted,
silently decrypt via qpdf with an empty password before proceeding.

Move CSP header generation from static .htaccess to dynamic PHP with per-request nonce,
preventing inline script violations while maintaining the same security policy.
Add generateCspNonce() and sendCspHeader() to security-helpers.php.

Other fixes:

  • Accept qpdf return code 3 (warnings) as success in decrypt-pdf.php
  • Prevent drag-and-drop of pages into panes with no PDF loaded
  • Remove inline onclick handlers from upload buttons (XSS surface reduction)
  • Remove unused checkIfPasswordProtected function and activeDropZones variable
  • Add ENABLE_DYNAMODB_LOG to README documentation tables
  • Add rate limit constants for the new assemble endpoint
Assets 2
Loading