aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_http_file_share.lua
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2021-01-28 17:13:49 +0100
committerKim Alvefur <zash@zash.se>2021-01-28 17:13:49 +0100
commitfab6ebb1e6b61e0692267f6f88ecba190be58f86 (patch)
treee13d62690c2907e421b3d392e194740ffa0866c9 /plugins/mod_http_file_share.lua
parent22e4d92ce51b576ccc30bfe3981f93c4b93cbfa5 (diff)
downloadprosody-fab6ebb1e6b61e0692267f6f88ecba190be58f86.tar.gz
prosody-fab6ebb1e6b61e0692267f6f88ecba190be58f86.zip
mod_http_file_share: Serve configurable set of safe mime types inline (thanks jonas’)
Otherwise people complain about browser 'Save as' dialog.
Diffstat (limited to 'plugins/mod_http_file_share.lua')
-rw-r--r--plugins/mod_http_file_share.lua9
1 files changed, 8 insertions, 1 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index feb21a16..e06ff82b 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -33,6 +33,7 @@ local secret = module:get_option_string(module.name.."_secret", require"util.id"
local external_base_url = module:get_option_string(module.name .. "_base_url");
local file_size_limit = module:get_option_number(module.name .. "_size_limit", 10 * 1024 * 1024); -- 10 MB
local file_types = module:get_option_set(module.name .. "_allowed_file_types", {});
+local safe_types = module:get_option_set(module.name .. "_safe_file_types", {"image/*","video/*","audio/*","text/plain"});
local expiry = module:get_option_number(module.name .. "_expires_after", 7 * 86400);
local access = module:get_option_set(module.name .. "_access", {});
@@ -278,10 +279,16 @@ function handle_download(event, path) -- GET /uploads/:slot+filename
if not handle then
return ferr or 410;
end
+
+ local disposition = "attachment";
+ if safe_types:contains(filetype) or safe_types:contains(filetype:gsub("/.*", "/*")) then
+ disposition = "inline";
+ end
+
response.headers.last_modified = last_modified;
response.headers.content_length = filesize;
response.headers.content_type = filetype or "application/octet-stream";
- response.headers.content_disposition = string.format("attachment; filename=%q", basename);
+ response.headers.content_disposition = string.format("%s; filename=%q", disposition, basename);
response.headers.cache_control = "max-age=31556952, immutable";
response.headers.content_security_policy = "default-src 'none'; frame-ancestors 'none';"