Inverle 7e5d2d0727 Change Content-Disposition: inline to attachment in f.php (#8344) ...

Some [misconfigured instances](https://github.com/FreshRSS/FreshRSS/issues/7835) may be stripping out the CSP header that `f.php` sends, which can be mitigated by forcing the browser to download the image instead of displaying it and executing JS code from unsanitized SVGs for example.

Contributes to https://github.com/FreshRSS/FreshRSS/pull/8263 and https://github.com/FreshRSS/FreshRSS/pull/7924
(improving security when CSP is not present)

2025-12-24 21:35:34 +01:00

2.1 KiB

Raw Blame History

View Raw