changement vers google drive storage pour les contrats.

Tentative d'obtenir un token de connection échoue

app/routes/users/_shared.py

@@ -39,6 +39,10 @@ def pdf_upload_error(file, allowed_extensions):
     could put an arbitrary file on the server under a name the application
     later hands back for download (SEC-021).
 
+    The check now goes beyond the header: it parses the upload with pypdf
+    and requires at least one parseable page, so a file with ``%PDF-``
+    prepended or a renamed non-PDF is rejected.
+
     Args:
         file: The uploaded FileStorage, or None.
         allowed_extensions: Extensions to accept, lowercase and without dot.
@@ -53,11 +57,27 @@ def pdf_upload_error(file, allowed_extensions):
     if not (stem and dot) or extension.lower() not in allowed_extensions:
         return _('Only PDF files are allowed for contracts.')
 
+    # Fast-fail: the PDF signature must appear at the start of the stream.
     head = file.stream.read(len(PDF_SIGNATURE))
     file.stream.seek(0)
     if head != PDF_SIGNATURE:
         return _('That file is not a PDF, whatever its name says.')
 
+    # Full-content validation: parse with pypdf and require at least one
+    # page.  A file with a forged header but no real PDF structure (e.g. a
+    # renamed executable with ``%PDF-`` prepended) will fail here.
+    try:
+        from pypdf import PdfReader
+        from pypdf.errors import PyPdfError
+
+        reader = PdfReader(file.stream, strict=False)
+        if len(reader.pages) == 0:
+            return _('That file is not a PDF, whatever its name says.')
+    except (PyPdfError, ValueError, TypeError):
+        return _('That file is not a PDF, whatever its name says.')
+    finally:
+        file.stream.seek(0)
+
     return None
 
 

app/routes/users/contracts.py

@@ -135,7 +135,9 @@ def upload_contract():
         try:
             stored_path = store_uploaded_document(file, relative_path)
         except GoogleDriveStorageError:
-            flash(_('Contract storage is temporarily unavailable. Please try again later.'), 'danger')
+            flash(
+                _('Contract storage is temporarily unavailable. Please try again later.'), 'danger'
+            )
             return redirect(url_for('users.upload_contract'))
 
         contract = Contract(