2 Commits

Include renames

Author	SHA1	Message	Date
Jeremy Daer	9c37f41ff6	Keep a multi-range upload response's multipart type ... A request for several byte ranges gets a 206 multipart/byteranges whose boundary the client needs to split the body. Rewriting it to octet-stream lost the boundary. No browser runs that type as a script, so it passes through.	2026-10-15 19:01:12 -07:00
Jeremy Daer	cad2d7211d	Serve uploads that aren't media as downloads ... Uploaded files come from this origin, so one served with a JavaScript type could run as one of the app's own scripts. Browsers accept sixteen spellings of that type, and Disk URLs sign the type they were minted with, so refusing a list of types at upload can't cover links already out there. Instead, a middleware rewrites the type of anything Active Storage reads out that isn't plainly media, a PDF or plain text to application/octet-stream, whatever the URL says.	2026-10-15 19:01:12 -07:00