Skip to content
Snippets Groups Projects
Commit 539d343d authored by Peter Rotich's avatar Peter Rotich
Browse files

Remove File Type Override

Remove file type overwrite previously used to force downloads. This
addresses potential XSS where an attacker could pass "image" resulting in
the file being displayed in line.
parent fac1c2db
No related branches found
No related tags found
No related merge requests found
......@@ -247,8 +247,6 @@ class AttachmentFile extends VerySimpleModel {
$ttl = ($expires) ? $expires - Misc::gmtime() : false;
$this->makeCacheable($ttl);
$type = $this->getType() ?: 'application/octet-stream';
if (isset($_REQUEST['overridetype']))
$type = $_REQUEST['overridetype'];
Http::download($this->getName(), $type, null, 'inline');
header('Content-Length: '.$this->getSize());
$this->sendData(false);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment