From 36e875e79677551d1c267d1d4efd9cbfd99d74bf Mon Sep 17 00:00:00 2001 From: Olivier Dony Date: Wed, 13 Jul 2016 19:46:38 +0200 Subject: [PATCH] [FIX] ir.http: make browsers trust our mime types We determine the mime types of the files we server automatically + manually, and browsers should not try to second-guess it. Browser mime-guessing is there for the myriads of badly configured web servers out there. --- openerp/addons/base/ir/ir_http.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openerp/addons/base/ir/ir_http.py b/openerp/addons/base/ir/ir_http.py index 90f03470696..34bb0035d1a 100644 --- a/openerp/addons/base/ir/ir_http.py +++ b/openerp/addons/base/ir/ir_http.py @@ -305,7 +305,7 @@ class ir_http(osv.AbstractModel): mimetype = attach_mimetype and attach_mimetype[0]['mimetype'] if not mimetype: mimetype = default_mimetype - headers.append(('Content-Type', mimetype)) + headers += [('Content-Type', mimetype), ('X-Content-Type-Options', 'nosniff')] # cache etag = hasattr(request, 'httprequest') and request.httprequest.headers.get('If-None-Match')