From c15dfcdca57cb91d6ecb38031a1a139986a40da6 Mon Sep 17 00:00:00 2001 From: Anirudh Oppiliappan Date: Fri, 1 Aug 2025 16:58:42 +0300 Subject: [PATCH] knotserver: also serve text/plain in BlobRaw Change-Id: qwknlvxtkwzvltqqtrxoxpxtnszywyyn Signed-off-by: Anirudh Oppiliappan --- knotserver/routes.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/knotserver/routes.go b/knotserver/routes.go index 8b37982..ba0afa3 100644 --- a/knotserver/routes.go +++ b/knotserver/routes.go @@ -286,9 +286,17 @@ func (h *Handle) BlobRaw(w http.ResponseWriter, r *http.Request) { mimeType = "image/svg+xml" } - if !strings.HasPrefix(mimeType, "image/") && !strings.HasPrefix(mimeType, "video/") { - l.Error("attempted to serve non-image/video file", "mimetype", mimeType) - writeError(w, "only image and video files can be accessed directly", http.StatusForbidden) + // allow image, video, and text/plain files to be served directly + switch { + case strings.HasPrefix(mimeType, "image/"): + // allowed + case strings.HasPrefix(mimeType, "video/"): + // allowed + case strings.HasPrefix(mimeType, "text/plain"): + // allowed + default: + l.Error("attempted to serve disallowed file type", "mimetype", mimeType) + writeError(w, "only image, video, and text files can be accessed directly", http.StatusForbidden) return } -- 2.43.0