mirror of
https://github.com/penpot/penpot.git
synced 2026-08-08 05:48:50 +00:00
2a0b75fe09
Add media type validation to upload-tempfile and upload-org-logo management endpoints. Both stored user-supplied mtype without checking against an allowlist. Only image types and PDF are permitted. Non-public bucket assets now also carry Content-Disposition: attachment to prevent inline rendering. AI-assisted-by: mimo-v2.5