Martin Brennan 3f7658cc6e SECURITY: Add content-disposition: attachment for SVG uploads ... * strip out the href and xlink:href attributes from use element that are _not_ anchors in svgs which can be used for XSS * adding the content-disposition: attachment ensures that uploaded SVGs cannot be opened and executed using the XSS exploit. svgs embedded using an img tag do not suffer from the same exploit		2020-07-09 13:54:45 +10:00
..
base_store.rb	FIX: Improvements and fixes to the image downsizing script (#9950)	2020-06-11 14:47:59 +02:00
local_store.rb	REFACTOR: Restoring of backups and migration of uploads to S3	2020-01-14 11:41:35 +01:00
s3_store.rb	SECURITY: Add content-disposition: attachment for SVG uploads	2020-07-09 13:54:45 +10:00
to_s3_migration.rb	SECURITY: Add content-disposition: attachment for SVG uploads	2020-07-09 13:54:45 +10:00