diff options
| author | Jonathan Tran <jonnytran@gmail.com> | 2021-01-12 22:45:19 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-01-12 22:45:19 -0500 |
| commit | 81467e6f35f343b911c09f746deca869a48da4c8 (patch) | |
| tree | 1b759007789bc0dbeeb543d54739ccf8b8dfb434 /routers/repo/download.go | |
| parent | 9465e60504284699078e620f7c892a9685d91458 (diff) | |
| download | gitea-81467e6f35f343b911c09f746deca869a48da4c8.tar.gz gitea-81467e6f35f343b911c09f746deca869a48da4c8.zip | |
Display SVG files as images instead of text (#14101)
* Change to display SVG files as images
* Remove unsafe styles from SVG CSP
* Add integration test to test SVG headers
* Add config setting to disable SVG rendering
* Add test for img tag when loading SVG image
* Remove the Raw view button for svg files since we don't fully support this
* Fix copyright year
* Rename and move config setting
* Add setting to cheat sheet in docs
* Fix so that comment matches cheat sheet
* Add allowing styles in CSP based on pull request feedback
* Re-enable raw button since we show SVG styles now
* Change so that SVG files are editable
* Add UI to toggle between source and rendered image for SVGs
* Change to show blame button for SVG images
* Fix to update ctx data
* Add test for DetectContentType when file is longer than sniffLen
Co-authored-by: Jonathan Tran <jon@allspice.io>
Co-authored-by: Kyle D <kdumontnu@gmail.com>
Diffstat (limited to 'routers/repo/download.go')
| -rw-r--r-- | routers/repo/download.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/routers/repo/download.go b/routers/repo/download.go index 2f1f2d3c47..f04dac6aa5 100644 --- a/routers/repo/download.go +++ b/routers/repo/download.go @@ -46,6 +46,11 @@ func ServeData(ctx *context.Context, name string, reader io.Reader) error { } else if base.IsImageFile(buf) || base.IsPDFFile(buf) { ctx.Resp.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, name)) ctx.Resp.Header().Set("Access-Control-Expose-Headers", "Content-Disposition") + if base.IsSVGImageFile(buf) { + ctx.Resp.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox") + ctx.Resp.Header().Set("X-Content-Type-Options", "nosniff") + ctx.Resp.Header().Set("Content-Type", base.SVGMimeType) + } } else { ctx.Resp.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, name)) ctx.Resp.Header().Set("Access-Control-Expose-Headers", "Content-Disposition") |