mirror of
https://github.com/dutchcoders/transfer.sh.git
synced 2026-02-03 14:13:26 +00:00
Fixed improper implementation of content type (#501)
* Fixed improper implementation of content type Add text/plain content type if metadata.ContentType is unable to determine the content type of the file * Update server/handlers.go Co-authored-by: Farhan Khursheed <41877347+blind-intruder@users.noreply.github.com> * Update handlers.go let's trim space * Update handlers.go Co-authored-by: Andrea Spacca <andrea.spacca@gmail.com>
This commit is contained in:
@@ -1034,6 +1034,13 @@ func (s *Server) getHandler(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
if action == "inline" {
|
||||
disposition = "inline"
|
||||
/*
|
||||
metadata.ContentType is unable to determine the type of the content,
|
||||
So add text/plain in this case to fix XSS related issues/
|
||||
*/
|
||||
if strings.TrimSpace(contentType) == "" {
|
||||
contentType = "text/plain"
|
||||
}
|
||||
} else {
|
||||
disposition = "attachment"
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user