John Cardinal 289058bad2 case 4727 - logo uploads checked by content, change rights, served sandboxed ...

Logo upload and delete need change rights on Global (was read rights,
which BizAdminRestricted has). The image type is taken from the bytes:
PNG, JPEG, GIF, WebP or SVG, anything else refused; the claimed type is
not stored. Downloads send nosniff and a sandbox Content-Security-Policy,
so an SVG opened by its URL runs no script. F23 fixed (4727 step 1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 20:56:56 -07:00

..

AyaNova

case 4727 - logo uploads checked by content, change rights, served sandboxed

2026-10-24 20:56:56 -07:00