Merge branch 'jn/mime-type-with-params'
authorJunio C Hamano <gitster@pobox.com>
Mon, 6 Jun 2011 18:40:22 +0000 (11:40 -0700)
committerJunio C Hamano <gitster@pobox.com>
Mon, 6 Jun 2011 18:40:22 +0000 (11:40 -0700)
* jn/mime-type-with-params:
gitweb: Fix usability of $prevent_xss

gitweb/gitweb.perl
index 240dd4701cc7f313b51754b0ffc7ca4a11ab0b7a..ebf2d1cf2c338e0f5e43f7220abcd8564294eb41 100755 (executable)
@@ -6127,7 +6127,7 @@ sub git_blob_plain {
        # want to be sure not to break that by serving the image as an
        # attachment (though Firefox 3 doesn't seem to care).
        my $sandbox = $prevent_xss &&
-               $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))$!;
+               $type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))(?:[ ;]|$)!;
 
        print $cgi->header(
                -type => $type,