From c40070ceb015b76e90572dbbf1be2ebbcf89ffb7 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Mon, 22 Aug 2022 11:37:26 +0300
Subject: [PATCH] download csp and fix

---
 application/Espo/EntryPoints/Download.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/application/Espo/EntryPoints/Download.php b/application/Espo/EntryPoints/Download.php
index fed268a6ac..75e40906db 100644
--- a/application/Espo/EntryPoints/Download.php
+++ b/application/Espo/EntryPoints/Download.php
@@ -93,11 +93,13 @@ class Download implements EntryPoint
 
         $disposition = 'attachment';
 
-        /** @var {string[]} $inlineMimeTypeList */
+        /** @var string[] $inlineMimeTypeList */
         $inlineMimeTypeList = $this->metadata->get(['app', 'file', 'inlineMimeTypeList']) ?? [];
 
         if (in_array($type, $inlineMimeTypeList)) {
             $disposition = 'inline';
+
+            $response->setHeader('Content-Security-Policy', "default-src 'self'");
         }
 
         $response->setHeader('Content-Description', 'File Transfer');