4189981995
add CSP header to files in `/media` This fixes a security issue of stored cross-site scripting via embedding JavaScript in SVG files by a malicious user with `can_save_media` capability. This can be exploited if: - the uploaded file is served from the same origin as authentik, and - the user opens the uploaded file directly in their browser Co-authored-by: Jens L. <jens@goauthentik.io> |
||
|---|---|---|
| .. | ||
| common | ||
| config | ||
| constants | ||
| crypto | ||
| debug | ||
| gounicorn | ||
| outpost | ||
| utils | ||
| web | ||