Jeremy Daer cad2d7211d Serve uploads that aren't media as downloads ...

Uploaded files come from this origin, so one served with a JavaScript
type could run as one of the app's own scripts. Browsers accept sixteen
spellings of that type, and Disk URLs sign the type they were minted
with, so refusing a list of types at upload can't cover links already
out there. Instead, a middleware rewrites the type of anything Active
Storage reads out that isn't plainly media, a PDF or plain text to
application/octet-stream, whatever the URL says.

2026-10-15 19:01:12 -07:00

..

channels

Keep same-second unread events and bound idle push connections

2026-10-07 11:00:47 +02:00

controllers

Keep transaction guards temporary and simplify quick boost forms

2026-10-08 12:40:31 +02:00

fixtures

Hash fixture passwords at minimum bcrypt cost

2026-09-29 09:53:39 +07:00

helpers

Hand auto_link text escaped the way the serializer writes it

2026-10-15 18:42:06 -07:00

lib

Test the pooled-connection class check on its own, and name the class

2026-10-09 23:41:45 +02:00

middleware

Serve uploads that aren't media as downloads

2026-10-15 19:01:12 -07:00

models

Clear no_proxy in the link preview proxy test

2026-10-09 16:45:43 +02:00

performance

Use header-only forgery protection and cache complete responses

2026-10-08 09:05:10 +02:00

system

Quote a mention as text when replying

2026-10-15 18:42:06 -07:00

test_helpers

Open pooled push connections as a Net::HTTP subclass that includes Stages

2026-10-09 23:41:45 +02:00

application_system_test_case.rb

Replace Trix with Lexxy

2026-09-26 09:13:27 +02:00

test_helper.rb

Keep fixtures :all; isolate trigger lifecycle tests

2026-10-07 20:14:13 +00:00