From 9491f07ade97a78a724b7e1cac2042c0893f9e86 Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Mon, 29 Nov 2021 15:57:39 +0100
Subject: [PATCH] fix deleting invoice documents (#2980)

---
 src/Constants.php                            | 4 ++--
 src/Controller/InvoiceController.php         | 4 ++--
 src/Repository/InvoiceDocumentRepository.php | 6 +++++-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/Constants.php b/src/Constants.php
index a4b0fb96..687519d7 100644
--- a/src/Constants.php
+++ b/src/Constants.php
@@ -17,11 +17,11 @@ class Constants
     /**
      * The current release version
      */
-    public const VERSION = '1.16.5';
+    public const VERSION = '1.16.6';
     /**
      * The current release: major * 10000 + minor * 100 + patch
      */
-    public const VERSION_ID = 11605;
+    public const VERSION_ID = 11606;
     /**
      * The current release status, either "stable" or "dev"
      */
diff --git a/src/Controller/InvoiceController.php b/src/Controller/InvoiceController.php
index f0c58e89..6fe96be2 100644
--- a/src/Controller/InvoiceController.php
+++ b/src/Controller/InvoiceController.php
@@ -443,8 +443,8 @@ final class InvoiceController extends AbstractController
 
         $csrfTokenManager->refreshToken('invoice.delete_document');
 
-        foreach ($documentRepository->findBuiltIn() as $document) {
-            if ($document->getId() === $id) {
+        foreach ($documentRepository->findBuiltIn() as $doc) {
+            if ($doc->getId() === $id) {
                 throw new \Exception('Document is built-in and cannot be deleted');
             }
         }
diff --git a/src/Repository/InvoiceDocumentRepository.php b/src/Repository/InvoiceDocumentRepository.php
index d409e9ac..14580b30 100644
--- a/src/Repository/InvoiceDocumentRepository.php
+++ b/src/Repository/InvoiceDocumentRepository.php
@@ -55,7 +55,11 @@ final class InvoiceDocumentRepository
      */
     public function remove(InvoiceDocument $invoiceDocument): void
     {
-        @unlink($invoiceDocument->getFilename());
+        if (stripos($invoiceDocument->getFilename(), $this->getUploadDirectory()) === false) {
+            throw new \InvalidArgumentException('Cannot delete built-in invoice template');
+        }
+
+        @unlink(realpath($invoiceDocument->getFilename()));
     }
 
     /**