From f974ca4fd4ba98b8351fa573912855499119cd5e Mon Sep 17 00:00:00 2001 From: fs Date: Sun, 5 Apr 2026 22:53:46 +0200 Subject: [PATCH] fix(helpdesk): add security headers and size limit to file proxy - X-Content-Type-Options: nosniff prevents MIME sniffing - Content-Security-Policy: sandbox prevents script execution - 20 MB size limit on decoded file data (413 on exceed) Co-Authored-By: Claude Opus 4.6 (1M context) --- .../helpdesk/pages/helpdesk/ticket-file-data().php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/modules/helpdesk/pages/helpdesk/ticket-file-data().php b/modules/helpdesk/pages/helpdesk/ticket-file-data().php index 089cbbf..aa828bc 100644 --- a/modules/helpdesk/pages/helpdesk/ticket-file-data().php +++ b/modules/helpdesk/pages/helpdesk/ticket-file-data().php @@ -45,7 +45,18 @@ if (!$result['ok'] || !isset($result['data'])) { } $data = $result['data']; +$maxFileSize = 20 * 1024 * 1024; // 20 MB + +if (strlen($data) > $maxFileSize) { + http_response_code(413); + Router::json(['ok' => false, 'error' => 'File too large']); + + return; +} $displayFilename = $filename !== '' ? $filename : 'attachment-' . $entryNo; +header('X-Content-Type-Options: nosniff'); +header('Content-Security-Policy: sandbox'); + Router::download($displayFilename, $data);