diff options
Diffstat (limited to 'api')
| -rw-r--r-- | api/file.go | 25 | ||||
| -rw-r--r-- | api/user.go | 2 |
2 files changed, 14 insertions, 13 deletions
diff --git a/api/file.go b/api/file.go index 19f69052d..ee9703455 100644 --- a/api/file.go +++ b/api/file.go @@ -379,7 +379,6 @@ func getFile(c *Context, w http.ResponseWriter, r *http.Request) { hash := r.URL.Query().Get("h") data := r.URL.Query().Get("d") teamId := r.URL.Query().Get("t") - isDownload := r.URL.Query().Get("download") == "1" cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId) @@ -419,21 +418,23 @@ func getFile(c *Context, w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Length", strconv.Itoa(len(f))) w.Header().Del("Content-Type") // Content-Type will be set automatically by the http writer - if isDownload { - // attach extra headers to trigger a download on IE, Edge, and Safari - ua := user_agent.New(r.UserAgent()) - bname, _ := ua.Browser() + // attach extra headers to trigger a download on IE, Edge, and Safari + ua := user_agent.New(r.UserAgent()) + bname, _ := ua.Browser() - parts := strings.Split(filename, "/") - filePart := strings.Split(parts[len(parts)-1], "?")[0] - w.Header().Set("Content-Disposition", "attachment;filename=\""+filePart+"\"") + parts := strings.Split(filename, "/") + filePart := strings.Split(parts[len(parts)-1], "?")[0] + w.Header().Set("Content-Disposition", "attachment;filename=\""+filePart+"\"") - if bname == "Edge" || bname == "Internet Explorer" || bname == "Safari" { - // trim off anything before the final / so we just get the file's name - w.Header().Set("Content-Type", "application/octet-stream") - } + if bname == "Edge" || bname == "Internet Explorer" || bname == "Safari" { + // trim off anything before the final / so we just get the file's name + w.Header().Set("Content-Type", "application/octet-stream") } + // prevent file links from being embedded in iframes + w.Header().Set("X-Frame-Options", "DENY") + w.Header().Set("Content-Security-Policy", "Frame-ancestors 'none'") + w.Write(f) } diff --git a/api/user.go b/api/user.go index ab13cbb68..76eeaa441 100644 --- a/api/user.go +++ b/api/user.go @@ -1836,7 +1836,7 @@ func sendEmailChangeEmailAndForget(c *Context, oldEmail, newEmail, teamDisplayNa func SendEmailChangeVerifyEmailAndForget(c *Context, userId, newUserEmail, teamName, teamDisplayName, siteURL, teamURL string) { go func() { - link := fmt.Sprintf("%s/verify_email?uid=%s&hid=%s&teamname=%s&email=%s", siteURL, userId, model.HashPassword(userId), teamName, newUserEmail) + link := fmt.Sprintf("%s/do_verify_email?uid=%s&hid=%s&teamname=%s&email=%s", siteURL, userId, model.HashPassword(userId), teamName, newUserEmail) subjectPage := utils.NewHTMLTemplate("email_change_verify_subject", c.Locale) subjectPage.Props["Subject"] = c.T("api.templates.email_change_verify_subject", |