From 2b1bb3835f3fae835e473a158055f8b492a51856 Mon Sep 17 00:00:00 2001 From: Eric Phetteplace Date: Thu, 12 Mar 2026 13:47:50 -0700 Subject: [PATCH] Bug 42080: Invoice PDFs are forced downloads Serve invoice files with a CSP header that prevents XSS instead of with an attachment header that turns them into downloads. Testing plan: - Set AcqEnableFiles preference to Do - Acquisitions > Vendor > Receive Shipment > Create invoice - Finish Receiving > Manage invoice files - Upload an SVG with a