sanitize only on inline content-disposition

2021-03-02 16:50:53 +01:00
parent 27f84e719a
commit b36711c1ea
1 changed files with 1 additions and 1 deletions
--- a/server/handlers.go
+++ b/server/handlers.go
@ -1010,7 +1010,7 @@ func (s *Server) getHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("X-Remaining-Days", remainingDays)


-	if strings.Contains(contentType, "html") {
+	if disposition == "inline" && strings.Contains(contentType, "html") {
 		reader = ioutil.NopCloser(
 			bytes.NewReader(
 				bluemonday.UGCPolicy().