Merge 2680d9fb23 into 6665515349

app/user_manager.py

@@ -343,13 +343,22 @@ class UserManager():
             # XSS). Content-Disposition: attachment is the load-bearing guard;
             # the content-type override and nosniff are defence in depth.
             content_type = mimetypes.guess_type(path)[0] or 'application/octet-stream'
-            if folder_paths.is_dangerous_content_type(content_type):
-                content_type = 'application/octet-stream'
+
+            # Strict check: allow inline loading only for the exact user.css file
+            is_user_css = os.path.basename(path) == "user.css"
+
+            if is_user_css:
+                content_type = "text/css"
+                disposition = "inline"
+            else:
+                if folder_paths.is_dangerous_content_type(content_type):
+                    content_type = 'application/octet-stream'
+                disposition = "attachment"
 
             return web.FileResponse(path, headers={
                 "Content-Type": content_type,
                 "X-Content-Type-Options": "nosniff",
-                "Content-Disposition": "attachment",
+                "Content-Disposition": disposition,
             })
 
         @routes.post("/userdata/{file}")