mraible commented on code in PR #174:
URL: https://github.com/apache/roller/pull/174#discussion_r3891453059
##########
app/src/main/java/org/apache/roller/weblogger/ui/rendering/servlets/ResourceServlet.java:
##########
@@ -159,8 +162,19 @@ public void doGet(HttpServletRequest request,
HttpServletResponse response)
}
// set the content type based on whatever is in our web.xml mime defs
- response.setContentType(this.context.getMimeType(resourceRequest
- .getResourcePath()));
+ String resourceType = this.context.getMimeType(
+ resourceRequest.getResourcePath());
+ if (fromUploadedMedia) {
+ // Uploaded through the media library, so it is governed by the
Review Comment:
This branch is also where customized-theme resources land:
`WeblogCustomTheme.getResource()` looks up the media file but never assigns it
to `resource`, so it always returns `null`, and `importTheme` stores theme
CSS/JS as media files with their original path. `resourceType` for
`css/bootstrap.css` is `text/css`, which isn't inline-safe, so the stylesheet
goes out as an octet-stream attachment with `nosniff` and the browser drops it.
Fixing `WeblogCustomTheme.getResource` to return the media file would route
these through the theme branch above; alternatively, treat `text/css` /
`text/javascript` from the servlet-context mime table as theme-authored here as
the description already promises.
##########
app/src/main/java/org/apache/roller/weblogger/ui/rendering/servlets/PreviewResourceServlet.java:
##########
@@ -160,8 +163,19 @@ public void doGet(HttpServletRequest request,
HttpServletResponse response)
}
// set the content type based on whatever is in our web.xml mime defs
- response.setContentType(this.context.getMimeType(resourceRequest
- .getResourcePath()));
+ String resourceType = this.context.getMimeType(
+ resourceRequest.getResourcePath());
+ if (fromUploadedMedia) {
+ // Uploaded through the media library, so it is governed by the
+ // same policy as any other media response.
+ MediaTypePolicy.applyResponseHeaders(response, resourceType,
Review Comment:
`context.getMimeType()` returns `null` for extensions not mapped in
`web.xml`/the container, and `applyResponseHeaders` turns `null` into an
octet-stream attachment. On master `setContentType(null)` left the type unset
and the browser could still display the file; now any unmapped (or uppercase,
on a case-sensitive container) extension downloads in the theme preview.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
