kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Dont allow html render for RAW view

Browse source
This commit is contained in:
Dmitriy Zaporozhets 2013-09-03 20:55:01 +03:00
parent 1de270c9e0
commit 38cebe03bc
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/controllers/projects/raw_controller.rb
View file

@ -11,9 +11,17 @@ class Projects::RawController < Projects::ApplicationController
@blob = Gitlab::Git::Blob.new(@repository, @commit.id, @ref, @path) @blob = Gitlab::Git::Blob.new(@repository, @commit.id, @ref, @path)
if @blob.exists? if @blob.exists?
type = if @blob.mime_type =~ /html|javascript/
'text/plain; charset=utf-8'
else
@blob.mime_type
end
headers['X-Content-Type-Options'] = 'nosniff'
send_data( send_data(
@blob.data, @blob.data,
type: @blob.mime_type, type: type,
disposition: 'inline', disposition: 'inline',
filename: @blob.name filename: @blob.name
) )