diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-09-03 20:55:01 +0300 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-09-03 20:55:01 +0300 |
| commit | 38cebe03bcd49895332401e5103925754ab7db85 (patch) | |
| tree | 29325b815f4ae1432338d84faa2c218116225ffb | |
| parent | 1de270c9e05658095711fd4cc1e8b2634fdf25cc (diff) | |
| download | gitlab-ce-38cebe03bcd49895332401e5103925754ab7db85.tar.gz | |
Dont allow html render for RAW view
| -rw-r--r-- | app/controllers/projects/raw_controller.rb | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb index 0d35f373e9c..0c23d411f4c 100644 --- a/app/controllers/projects/raw_controller.rb +++ b/app/controllers/projects/raw_controller.rb @@ -11,9 +11,17 @@ class Projects::RawController < Projects::ApplicationController @blob = Gitlab::Git::Blob.new(@repository, @commit.id, @ref, @path) if @blob.exists? + type = if @blob.mime_type =~ /html|javascript/ + 'text/plain; charset=utf-8' + else + @blob.mime_type + end + + headers['X-Content-Type-Options'] = 'nosniff' + send_data( @blob.data, - type: @blob.mime_type, + type: type, disposition: 'inline', filename: @blob.name ) |