{"push_id":776379506,"size":3,"distinct_size":2,"ref":"refs/heads/pulls/contentdisposition-fix","head":"a6161c283030c336fca22d75000d579cc64bff47","before":"f9a0baf7544752352bd469036fd79ac581233c61","commits":[{"sha":"b87c92cc5fcfdcef3d1acd8d087f7a129b32de15","author":{"email":"cc9cb67faf653125a39b232ccf4c0cf195507cc9@madman.net.nz","name":"madmatt"},"message":"SECURITY: Ensure appropriate Cache-control headers are set.\n\nFix the cache headers to ensure that files served through SecureFileController\nare never cached. This ensures that even if the website is fronted by a\nCDN/edge caching network, all requests for secure assets should always be\nserved dynamically, and therefore all users will be checked to ensure they have\nthe correct permissions.\n\nPreviously, if an administrator viewed a file, some CDNs may have mistakenly\ncached the response, meaning that anyone guessing the filename could download\nit without being authenticated.","distinct":false,"url":"https://api.github.com/repos/madmatt/silverstripe-secureassets/commits/b87c92cc5fcfdcef3d1acd8d087f7a129b32de15"},{"sha":"6120a21ab735908156bd0d62d1e423bb2db9569f","author":{"email":"81506e60eee71dc76c4134679bb4df3d66491c5e@silverstripe.com","name":"Damian Mooyman"},"message":"Merge pull request #27 from madmatt/pulls/cachecontrol-fix\n\nSECURITY: Ensure appropriate Cache-control headers are set.","distinct":true,"url":"https://api.github.com/repos/madmatt/silverstripe-secureassets/commits/6120a21ab735908156bd0d62d1e423bb2db9569f"},{"sha":"a6161c283030c336fca22d75000d579cc64bff47","author":{"email":"cc9cb67faf653125a39b232ccf4c0cf195507cc9@madman.net.nz","name":"madmatt"},"message":"SECURITY: Correctly set Content-disposition header\n\n- If Content-disposition header is set to inline, then malicious files stored in\nthe secured folder can be run in the logged-in user's context (e.g. HTML files\nthat run some AJAX to modify things in the CMS). This change forces the\n'attachment' disposition by default that ensures the browser is forced to\ndownload these files rather than displaying them inline. A further fix might be\nto use mime validation instead of a single-purpose rule, to allow e.g. image\nfiles to use inline. New configuration option added to allow the default to be\nchanged if required.\n\nDocumentation added to describe the new default behaviour.\n\nThanks to Chris McCurley of Aura Information Security for reporting this issue.","distinct":true,"url":"https://api.github.com/repos/madmatt/silverstripe-secureassets/commits/a6161c283030c336fca22d75000d579cc64bff47"}]}