From: Patrick Canterino <patrick@patrick-canterino.de>
Date: Sun, 4 Jan 2026 13:54:55 +0000 (+0100)
Subject: Disable MIME sniffing to prevent preview of invalid (propably harmful) file types
X-Git-Tag: 4.7.1~8^2
X-Git-Url: https://git.p6c8.net/jirafeau/pcanterino.git/commitdiff_plain/747afb20bfcff14bb67e40e7035d47a6311ba3e1?ds=sidebyside

Disable MIME sniffing to prevent preview of invalid (propably harmful) file types

Reported by Yann CAM and Killian CHEVRIER
---

diff --git a/f.php b/f.php
index 922668f..269b10b 100644
--- a/f.php
+++ b/f.php
@@ -231,6 +231,7 @@ if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_downloa
     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 } else {
     header('Content-Disposition: filename="' . $link['file_name'] . '"');
+    header('X-Content-Type-Options: nosniff');
 }
 header('Content-Type: ' . $link['mime_type']);
 if ($cfg['file_hash'] == "md5") {