2 Commits

Include renames

Author	SHA1	Message	Date
Jeremy Daer	27f7b8a9b0	Keep a multi-range upload response's multipart type ... A request for several byte ranges gets a 206 multipart/byteranges whose boundary the client needs to split the body. Rewriting it to octet-stream lost the boundary. No browser runs that type as a script, so it passes through. (cherry picked from commit 9c37f41ff6)	2026-10-17 00:47:32 -07:00
Jeremy Daer	3a140f65b2	Serve uploads that aren't media as downloads ... Uploaded files come from this origin, so one served with a JavaScript type could run as one of the app's own scripts. Browsers accept sixteen spellings of that type, and Disk URLs sign the type they were minted with, so refusing a list of types at upload can't cover links already out there. Instead, a middleware rewrites the type of anything Active Storage reads out that isn't plainly media, a PDF or plain text to application/octet-stream, whatever the URL says. (cherry picked from commit cad2d7211d)	2026-10-17 00:47:22 -07:00