From f7324ee73ceea1b40c68e8b1d2e336196af09c07 Mon Sep 17 00:00:00 2001 From: Hampus Date: Thu, 13 Aug 2026 13:56:59 +0200 Subject: [PATCH] fix(media-proxy): force SVG and PDF downloads (#1575) --- fluxer_media_proxy/src/disposition.rs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fluxer_media_proxy/src/disposition.rs b/fluxer_media_proxy/src/disposition.rs index f21d044a7..56697b88c 100644 --- a/fluxer_media_proxy/src/disposition.rs +++ b/fluxer_media_proxy/src/disposition.rs @@ -29,7 +29,7 @@ fn normalize_mime(content_type: &str) -> &str { pub fn is_inline_viewable(content_type: &str) -> bool { let mime = normalize_mime(content_type); - if mime.eq_ignore_ascii_case("image/svg+xml") { + if is_scriptable_document(mime) { return false; } if mime.len() >= 6 && mime[..6].eq_ignore_ascii_case("image/") { @@ -38,7 +38,12 @@ pub fn is_inline_viewable(content_type: &str) -> bool { if mime.len() >= 6 && mime[..6].eq_ignore_ascii_case("video/") { return true; } - mime.eq_ignore_ascii_case("application/pdf") + false +} + +fn is_scriptable_document(mime: &str) -> bool { + mime.eq_ignore_ascii_case("image/svg+xml") + || mime.eq_ignore_ascii_case("application/pdf") } fn is_safe_quoted_filename(s: &str) -> bool { @@ -113,7 +118,7 @@ mod tests { decide("image/jpeg; charset=binary", false) ); assert_eq!(Decision::Inline, decide("video/mp4", false)); - assert_eq!(Decision::Inline, decide("application/pdf", false)); + assert_eq!(Decision::Attachment, decide("application/pdf", false)); assert_eq!(Decision::Attachment, decide("image/svg+xml", false)); assert_eq!( Decision::Attachment,