From e92367b3f6839bdb64139f72d5046495f38c9228 Mon Sep 17 00:00:00 2001 From: Jeremy Stretch Date: Thu, 18 Jun 2026 17:09:04 -0400 Subject: [PATCH] Fixes #22480: Revert forced handling of image attachments as downloads (#22493) --- netbox/netbox/tests/test_views.py | 8 ++++---- netbox/netbox/views/misc.py | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/netbox/netbox/tests/test_views.py b/netbox/netbox/tests/test_views.py index 96c31ba16..bc5306227 100644 --- a/netbox/netbox/tests/test_views.py +++ b/netbox/netbox/tests/test_views.py @@ -124,8 +124,8 @@ class MediaViewTestCase(TestCase): with patch('netbox.views.misc.serve', return_value=HttpResponse(status=200)): response = self.client.get(url) self.assertHttpStatus(response, 200) - self.assertEqual(response['Content-Disposition'], 'attachment') - self.assertEqual(response['X-Content-Type-Options'], 'nosniff') + self.assertEqual(response['Content-Security-Policy'], "sandbox; default-src 'none'") + self.assertEqual(response['X-Content-Type-Options'], "nosniff") def test_image_attachment_without_permission(self): url = reverse('media', kwargs={'path': self.image_attachment.image.name}) @@ -145,8 +145,8 @@ class MediaViewTestCase(TestCase): with patch('netbox.views.misc.serve', return_value=HttpResponse(status=200)): response = self.client.get(url) self.assertHttpStatus(response, 200) - self.assertEqual(response['Content-Disposition'], 'attachment') - self.assertEqual(response['X-Content-Type-Options'], 'nosniff') + self.assertEqual(response['Content-Security-Policy'], "sandbox; default-src 'none'") + self.assertEqual(response['X-Content-Type-Options'], "nosniff") def test_device_type_without_permission(self): url = reverse('media', kwargs={'path': self.device_type.front_image.name}) diff --git a/netbox/netbox/views/misc.py b/netbox/netbox/views/misc.py index 2eeba7cb8..ee3c11c59 100644 --- a/netbox/netbox/views/misc.py +++ b/netbox/netbox/views/misc.py @@ -159,6 +159,6 @@ class MediaView(TokenConditionalLoginRequiredMixin, View): raise Http404 response = serve(request, path, document_root=settings.MEDIA_ROOT) - response['Content-Disposition'] = 'attachment' - response['X-Content-Type-Options'] = 'nosniff' + response['Content-Security-Policy'] = "sandbox; default-src 'none'" + response['X-Content-Type-Options'] = "nosniff" return response