shahondin1624/Mitgliederverwaltung
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

No Content-Security-Policy headers on file download responses #173

New Issue
Closed
opened 2026-04-10 16:04:17 +02:00 by shahondin1624 · 0 comments
shahondin1624 commented 2026-04-10 16:04:17 +02:00
Owner
Copy Link
Copy Source

Severity: LOW

Location

lib/Controller/ExportController.php, lib/Controller/ReportController.php

Description

File download responses (CSV, PDF, ZIP) don't set Content-Disposition: attachment explicitly in all cases, which could allow browser rendering of potentially malicious content (CSV injection).

Recommendation

Always set Content-Disposition: attachment; filename="..." and X-Content-Type-Options: nosniff on download responses.

## Severity: LOW ## Location `lib/Controller/ExportController.php`, `lib/Controller/ReportController.php` ## Description File download responses (CSV, PDF, ZIP) don't set `Content-Disposition: attachment` explicitly in all cases, which could allow browser rendering of potentially malicious content (CSV injection). ## Recommendation Always set `Content-Disposition: attachment; filename="..."` and `X-Content-Type-Options: nosniff` on download responses.
shahondin1624 added the backendsecuritypriority:low labels 2026-04-10 16:04:17 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
backend
Backend / PHP work
 bug
Bug report
 database
Database migrations and schema
 documentation
Documentation
 enhancement
Enhancement or improvement
 epic
Epic / feature-group issues
 frontend
Frontend / Vue.js work
 integration
Nextcloud integrations (Calendar, Contacts, Files)
 priority:high
High priority
 priority:low
Low priority
 priority:medium
Medium priority
 security
Security-related work
 testing
Tests and test infrastructure
No Label backend priority:low security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
shahondin1624
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shahondin1624/Mitgliederverwaltung#173
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?