Jeremy Daer 3a140f65b2 Serve uploads that aren't media as downloads ...

Uploaded files come from this origin, so one served with a JavaScript
type could run as one of the app's own scripts. Browsers accept sixteen
spellings of that type, and Disk URLs sign the type they were minted
with, so refusing a list of types at upload can't cover links already
out there. Instead, a middleware rewrites the type of anything Active
Storage reads out that isn't plainly media, a PDF or plain text to
application/octet-stream, whatever the URL says.

(cherry picked from commit cad2d7211d)

2026-10-17 00:47:22 -07:00

..

channels

Keep same-second unread events and bound idle push connections

2026-10-07 11:00:47 +02:00

controllers

Render a complete auto-submit transfer form

2026-10-07 17:08:48 +02:00

fixtures

Hash fixture passwords at minimum bcrypt cost

2026-09-29 09:53:39 +07:00

helpers

Link URLs only in a message's text

2026-10-17 00:46:37 -07:00

lib

Keep same-second unread events and bound idle push connections

2026-10-07 11:00:47 +02:00

middleware

Serve uploads that aren't media as downloads

2026-10-17 00:47:22 -07:00

models

Stop sending push notifications to banned users (#338)

2026-10-07 11:25:16 -07:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Quote a mention as text when replying

2026-10-17 00:46:37 -07:00

test_helpers

Reuse push connections pinned to the address the guard just approved

2026-10-05 18:24:41 +02:00

application_system_test_case.rb

Replace Trix with Lexxy

2026-09-26 09:13:27 +02:00

test_helper.rb

Update Rails to main

2026-10-05 11:45:37 -04:00