4189981995
add CSP header to files in `/media` This fixes a security issue of stored cross-site scripting via embedding JavaScript in SVG files by a malicious user with `can_save_media` capability. This can be exploited if: - the uploaded file is served from the same origin as authentik, and - the user opens the uploaded file directly in their browser Co-authored-by: Jens L. <jens@goauthentik.io> |
||
|---|---|---|
| .. | ||
| brand_tls | ||
| metrics.go | ||
| proxy.go | ||
| static.go | ||
| web.go | ||
| web_tls.go | ||