a

internal/webclient/server.go

@@ -70,6 +70,7 @@ func (s *Server) setupRoutes() {
 	m.HandleFunc("POST /mail/{boxid}/{uid}/flag", s.require(s.messageFlag))
 	m.HandleFunc("POST /mail/{boxid}/{uid}/trash", s.require(s.messageTrash))
 	m.HandleFunc("POST /mail/{boxid}/{uid}/move", s.require(s.messageMove))
+	m.HandleFunc("GET /mail/{boxid}/{uid}/attachment/{n}", s.require(s.messageAttachment))
 	m.HandleFunc("POST /mail/{boxid}/expunge", s.require(s.mailboxExpunge))
 
 	// Compose
@@ -156,7 +157,7 @@ func (s *Server) render(w http.ResponseWriter, page string, data any) {
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
-	w.Header().Set("X-Frame-Options", "SAMEORIGIN")
+	w.Header().Set("X-Frame-Options", "DENY")
 	if err := t.ExecuteTemplate(w, "base", data); err != nil {
 		log.Printf("[webmail] template exec %s: %v", page, err)
 	}