{"action":"closed","issue":{"url":"https://api.github.com/repos/owncloud/gallery/issues/347","labels_url":"https://api.github.com/repos/owncloud/gallery/issues/347/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/gallery/issues/347/comments","events_url":"https://api.github.com/repos/owncloud/gallery/issues/347/events","html_url":"https://github.com/owncloud/gallery/issues/347","id":106583264,"number":347,"title":"Should use secure mimetypes instead of generic ones for download routes","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/gallery/labels/QA%20-%20Testing","name":"QA - Testing","color":"02d7e1"},{"url":"https://api.github.com/repos/owncloud/gallery/labels/security","name":"security","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"oparoz","id":323220,"avatar_url":"https://avatars.githubusercontent.com/u/323220?v=3","gravatar_id":"","url":"https://api.github.com/users/oparoz","html_url":"https://github.com/oparoz","followers_url":"https://api.github.com/users/oparoz/followers","following_url":"https://api.github.com/users/oparoz/following{/other_user}","gists_url":"https://api.github.com/users/oparoz/gists{/gist_id}","starred_url":"https://api.github.com/users/oparoz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oparoz/subscriptions","organizations_url":"https://api.github.com/users/oparoz/orgs","repos_url":"https://api.github.com/users/oparoz/repos","events_url":"https://api.github.com/users/oparoz/events{/privacy}","received_events_url":"https://api.github.com/users/oparoz/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/owncloud/gallery/milestones/12","html_url":"https://github.com/owncloud/gallery/milestones/8.2-current","labels_url":"https://api.github.com/repos/owncloud/gallery/milestones/12/labels","id":1203146,"number":12,"title":"8.2-current","description":"","creator":{"login":"oparoz","id":323220,"avatar_url":"https://avatars.githubusercontent.com/u/323220?v=3","gravatar_id":"","url":"https://api.github.com/users/oparoz","html_url":"https://github.com/oparoz","followers_url":"https://api.github.com/users/oparoz/followers","following_url":"https://api.github.com/users/oparoz/following{/other_user}","gists_url":"https://api.github.com/users/oparoz/gists{/gist_id}","starred_url":"https://api.github.com/users/oparoz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oparoz/subscriptions","organizations_url":"https://api.github.com/users/oparoz/orgs","repos_url":"https://api.github.com/users/oparoz/repos","events_url":"https://api.github.com/users/oparoz/events{/privacy}","received_events_url":"https://api.github.com/users/oparoz/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":65,"state":"open","created_at":"2015-07-10T23:34:09Z","updated_at":"2015-09-24T13:36:46Z","due_on":"2015-10-20T04:00:00Z","closed_at":null},"comments":8,"created_at":"2015-09-15T15:35:57Z","updated_at":"2015-09-24T13:36:46Z","closed_at":"2015-09-24T13:36:46Z","body":"See https://github.com/owncloud/core/pull/10938 for reasoning\r\n\r\n```\r\nGET /master/index.php/apps/gallery/files/download/3?c=b2a1325df3e7968027e36a3fe7bf8be8&requesttoken=8947b86c939d724cd60efe4a165e9129f7f7b155b41e0ea1095c84028d336537%7CyRbLmmgx%2FB7Jkpoz%7Cf80eb122cbb7f40379bdf45a3792641787bcd5d6410ce0463045a0482729ce86cc71b6f4837832488a9d7143280a93a1ca3acb0805a21b878092ed0fad4f76a0%3A4NlU4wom3c HTTP/1.1\r\nHost: localhost\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:40.0) Gecko/20100101 Firefox/40.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nCookie: ocnqhvnh1crb=402c3ing7r53kn1dgp225i7p27; oc_sessionPassphrase=vx00ticTJMER1O8oemQbj5FK3pMGIXkUwuqNuqjjpK%2BK1jY1hiye76hB2fsoBTfarqIB3VhW6AMU0pdrIVs1wI%2FwMnygUJC%2Fwm07OGRU1gcBQU50N6%2FgNr%2FyeGfInsun\r\nConnection: keep-alive\r\n```\r\n\r\n```\r\nHTTP/1.1 200 OK\r\nDate: Tue, 15 Sep 2015 15:34:04 GMT\r\nServer: Apache/2.4.16 (Unix) PHP/5.6.11\r\nX-Powered-By: PHP/5.6.11\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'none';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data:;font-src 'self';connect-src 'self';media-src 'self'\r\nContent-Disposition: attachment; filename*=UTF-8''welcome.js; filename=\"welcome.js\"\r\nContent-Length: 163\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nX-Robots-Tag: none\r\nX-Frame-Options: SAMEORIGIN\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: application/javascript; charset=utf-8\r\n\r\nWelcome to your ownCloud account!\r\n\r\nThis is just an example file for developers and git users. \r\nThe packaged and released versions will come with better examples.\r\n``` \r\n\r\nThis should use a secure mimetype alternative instead of `application/javascript`. Such as via `\\OC::$server->getMimeTypeDetector()->getSecureMimeType()`.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/26704364-should-use-secure-mimetypes-instead-of-generic-ones-for-download-routes?utm_campaign=plugin&utm_content=tracker%2F9328526&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F9328526&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"}}