780a59c908
internal: add CSP header to files in `/media` (#12092) add CSP header to files in `/media` This fixes a security issue of stored cross-site scripting via embedding JavaScript in SVG files by a malicious user with `can_save_media` capability. This can be exploited if: - the uploaded file is served from the same origin as authentik, and - the user opens the uploaded file directly in their browser Co-authored-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Jens L. <jens@goauthentik.io>