Linus Rath dd796d7325 fix: serve WOPI file downloads as inert attachments ...

GetFile answered on the webmail origin with the Content-Type stored in
the WOPI token, which for a mail attachment comes straight from the
launch request and for a Files node is a user-settable property. No
CSP, nosniff or disposition was added, since `/api/*` skips the proxy.
A user could mint a token for their own blob typed `text/html` and have
a victim open the GetFile URL, running script in the webmail origin.

GetFile now always sends `application/octet-stream` with
`Content-Disposition: attachment`, `nosniff` and a sandboxing CSP, and
refuses browser loads (any `Sec-Fetch-Dest` other than `empty`). The
editor fetches it server-to-server, so it is unaffected.

2026-09-26 14:16:42 +02:00

..

files/[fileId]

fix: serve WOPI file downloads as inert attachments

2026-09-26 14:16:42 +02:00

launch

fix: reject cross-origin writes to the JMAP passthrough and other cookie-authed routes (GHSA-9mvj-98f5-9q6g)

2026-09-26 14:08:44 +02:00

status

feat: WOPI office document editing in Files (Collabora/OnlyOffice/EuroOffice) #425

2026-08-31 23:16:19 +02:00