Return True if we should allow inline rendering for this file. Rationale: inline-rendering active content (HTML/SVG/XML) on the main app origin enables stored XSS via user uploads. We therefore force download for risky types while preserving inline previews for common media.
(mime: str, filename: str = "")
| 3161 | # Restore protected elements. |
| 3162 | body = body.replace(">__THEME_BTN__<", ">Theme<") |
| 3163 | body = body.replace(">__LANG_TARGET_EN__<", ">English<") |
| 3164 | body = body.replace(">__LANG_TARGET_EL__<", ">Ελληνικά<") |
| 3165 | body = body.replace(">__BRAND__<", ">ButSystem<") |
| 3166 | |
| 3167 | # Restore protected user message bodies (DM + Group) so placeholders never leak to UI. |
| 3168 | try: |
| 3169 | for i, _txt in enumerate(_msg_store): |
| 3170 | body = body.replace(f"__MSG_{i}__", _txt) |
| 3171 | except Exception: |
| 3172 | pass |
| 3173 | |
| 3174 | |
| 3175 | resp.set_data(body) |
| 3176 | return resp |
| 3177 | except Exception: |
| 3178 | return resp |
| 3179 | |
| 3180 | def login_required(fn): |
| 3181 | """login_required. |
| 3182 | |
| 3183 | Route handler or application helper. |
| 3184 | |
| 3185 | This docstring was expanded to make future maintenance easier. |
| 3186 | |
| 3187 | Args: |
no outgoing calls
no test coverage detected