Bug 453425 - Send "X-Content-Type-Options: nosniff" header when displaying attachment...

[r=LpSolit a=LpSolit]

diff --git a/attachment.cgi b/attachment.cgi
index 5bb2a85371ae56940a79b2c38d3504cc3125130a..8e69d388fd2e0033707b89e54a7ac2413ddc50e5 100755 (executable)
--- a/attachment.cgi
+++ b/attachment.cgi
@@ -338,7 +338,8 @@ sub view {
     }
     print $cgi->header(-type=>"$contenttype; name=\"$filename\"",
                        -content_disposition=> "$disposition; filename=\"$filename\"",
-                       -content_length => $attachment->datasize);
+                       -content_length => $attachment->datasize,
+                       -x_content_type_options => "nosniff");
     disable_utf8();
     print $attachment->data;
 }