fix deleting invoice documents (#2980)

src/Constants.php

@@ -17,11 +17,11 @@ class Constants
     /**
      * The current release version
      */
-    public const VERSION = '1.16.5';
+    public const VERSION = '1.16.6';
     /**
      * The current release: major * 10000 + minor * 100 + patch
      */
-    public const VERSION_ID = 11605;
+    public const VERSION_ID = 11606;
     /**
      * The current release status, either "stable" or "dev"
      */

src/Controller/InvoiceController.php

@@ -443,8 +443,8 @@ final class InvoiceController extends AbstractController
 
         $csrfTokenManager->refreshToken('invoice.delete_document');
 
-        foreach ($documentRepository->findBuiltIn() as $document) {
-            if ($document->getId() === $id) {
+        foreach ($documentRepository->findBuiltIn() as $doc) {
+            if ($doc->getId() === $id) {
                 throw new \Exception('Document is built-in and cannot be deleted');
             }
         }

src/Repository/InvoiceDocumentRepository.php

@@ -55,7 +55,11 @@ final class InvoiceDocumentRepository
      */
     public function remove(InvoiceDocument $invoiceDocument): void
     {
-        @unlink($invoiceDocument->getFilename());
+        if (stripos($invoiceDocument->getFilename(), $this->getUploadDirectory()) === false) {
+            throw new \InvalidArgumentException('Cannot delete built-in invoice template');
+        }
+
+        @unlink(realpath($invoiceDocument->getFilename()));
     }
 
     /**