ahtlon/deck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Use object-src self/blob for pdf files

Browse Source 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
This commit is contained in:
Julius Härtl
2018-06-14 11:25:17 +02:00
parent 0b5ded2860
commit 5bc65a6eb3
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
lib/Service/FileService.php
View File

@@ -24,7 +24,10 @@
namespace OCA\Deck\Service;
use OC\Security\CSP\ContentSecurityPolicyManager;
use OCA\Deck\Db\Attachment;
use OCP\AppFramework\Http\ContentSecurityPolicy;
use OCP\AppFramework\Http\EmptyContentSecurityPolicy;
use OCP\AppFramework\Http\FileDisplayResponse;
use OCP\Files\IAppData;
use OCP\Files\NotFoundException;
@@ -158,6 +161,14 @@ class FileService implements IAttachmentService {
public function display(Attachment $attachment) {
$file = $this->getFileForAttachment($attachment);
$response = new FileDisplayResponse($file);
if ($file->getMimeType() === 'application/pdf') {
// We need those since otherwise chrome won't show the PDF file with CSP rule object-src 'none'
// https://bugs.chromium.org/p/chromium/issues/detail?id=271452
$policy = new ContentSecurityPolicy();
$policy->addAllowedObjectDomain('\'self\'');
$policy->addAllowedObjectDomain('blob:');
$response->setContentSecurityPolicy($policy);
}
$response->addHeader('Content-Type', $file->getMimeType());
return $response;
}