From 4dd4fbc440237d1d84aba7afb0d5bb688ad48b7c Mon Sep 17 00:00:00 2001 From: Eric Phetteplace Date: Thu, 12 Mar 2026 13:47:50 -0700 Subject: [PATCH] Bug 42080: Invoice PDFs are forced downloads Serve invoice files with a CSP header that prevents XSS instead of with an attachment header that turns them into downloads. Testing plan: - Set AcqEnableFiles preference to Do - Acquisitions > Vendor > Receive Shipment > Create invoice - Finish Receiving > Manage invoice files - Upload an SVG with a