修改安全策略

server/router/fileserver/fileserver.go

@@ -451,7 +451,7 @@ func (s *FileServerService) getThumbnailPath(attachment *store.Attachment) (stri
 	if err := os.MkdirAll(cacheFolder, os.ModePerm); err != nil {
 		return "", errors.Wrap(err, "failed to create thumbnail cache folder")
 	}
-	filename := fmt.Sprintf("%s.v2.jpeg", attachment.UID)
+	filename := fmt.Sprintf("%s.jpeg", attachment.UID)
 	return filepath.Join(cacheFolder, filename), nil
 }
 
@@ -743,7 +743,7 @@ func setSecurityHeaders(c *echo.Context) {
 	h := c.Response().Header()
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("X-Frame-Options", "DENY")
-	h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline';")
+	h.Set("Content-Security-Policy", "default-src 'self'; style-src 'unsafe-inline';")
 }
 
 // setMediaHeaders sets headers for media file responses.

server/router/fileserver/fileserver_test.go

@@ -282,7 +282,7 @@ func TestServeAttachmentFile_SVGThumbnailServedAsImageWithSecurityHeaders(t *tes
 	require.Equal(t, "image/svg+xml", rec.Header().Get("Content-Type"))
 	require.Empty(t, rec.Header().Get("Content-Disposition"))
 	require.Equal(t, "nosniff", rec.Header().Get("X-Content-Type-Options"))
-	require.Equal(t, "default-src 'none'; style-src 'unsafe-inline';", rec.Header().Get("Content-Security-Policy"))
+	require.Equal(t, "default-src 'self'; style-src 'unsafe-inline';", rec.Header().Get("Content-Security-Policy"))
 	require.Equal(t, svgContent, rec.Body.Bytes())
 }