feat: remove .html and .svg from allowed upload types and MIME mappings

Remove HTML and SVG file extensions from the ALLOWED_UPLOAD_TYPES dictionary and their corresponding MIME type entries from MIME_TO_EXT in attachments.py, preventing users from uploading these potentially unsafe file formats through the API.
2026-06-16 06:50:16 +00:00
parent 99ed5c4f15
commit a618a95671
7 changed files with 86 additions and 10 deletions
@@ -47,7 +47,7 @@ def test_delete_comment_scrolls_to_previous_comment(alice):
    expect(page.locator(f".comment-text:has-text('{target}')")).to_have_count(0)

    page.wait_for_function(
-        "expected => Math.abs(window.scrollY - expected) < 120",
+        "expected => { const max = document.documentElement.scrollHeight - window.innerHeight; return Math.abs(window.scrollY - Math.min(expected, max)) < 120; }",
        arg=anchor_top,
    )
    expect(previous_wrapper).to_be_visible()