composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-24 11:08:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/support/2.7' into develop

Browse Source 
# Conflicts:
#	application/itopwebpage.class.inc.php
#	core/config.class.inc.php
#	setup/setuputils.class.inc.php
This commit is contained in:
Molkobain
2021-08-18 18:55:56 +02:00
parent 909af7f59c 1c983e8093
commit 1613c1bbdc
4 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
datamodels/2.x/itop-portal-base/portal/src/Controller/ObjectController.php
View File

@@ -1097,6 +1097,11 @@ class ObjectController extends BrickController
$aHeaders['Content-Type'] = $oDocument->GetMimeType();
$aHeaders['Content-Disposition'] = (($sOperation === 'display') ? 'inline' : 'attachment').';filename="'.$oDocument->GetFileName().'"';
// N°4129 - Prevent XSS attacks & other script executions
if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
$aHeaders['Content-Security-Policy'] = 'sandbox';
}
return new Response($oDocument->GetData(), Response::HTTP_OK, $aHeaders);
}