Set correct content type for JSON responses

Signed-off-by: Michal Čihař <michal@cihar.com>

import_status.php

@@ -75,12 +75,12 @@
 }
  */
 
-// AJAX requests can't be cached!
-PMA_noCacheHeader();
-
 // $_GET["message"] is used for asking for an import message
 if (isset($_GET["message"]) && $_GET["message"]) {
 
+    // AJAX requests can't be cached!
+    PMA_noCacheHeader();
+
     header('Content-type: text/html');
 
     // wait 0.3 sec before we check for $_SESSION variable,

libraries/Response.class.php

@@ -369,10 +369,7 @@ private function _ajaxResponse()
 
         // Set the Content-Type header to JSON so that jQuery parses the
         // response correctly.
-        if (! defined('TESTSUITE')) {
-            header('Cache-Control: no-cache');
-            header('Content-Type: application/json');
-        }
+        PMA_headerJSON();
 
         echo json_encode($this->_JSON);
     }

libraries/core.lib.php

@@ -630,6 +630,26 @@ function PMA_sendHeaderLocation($uri, $use_refresh = false)
     }
 }
 
+/**
+ * Outputs application/json headers. This includes no caching.
+ *
+ * @return void
+ */
+function PMA_headerJSON()
+{
+    if (defined('TESTSUITE') && ! defined('PMA_TEST_HEADERS')) {
+        return;
+    }
+    // No caching
+    PMA_noCacheHeader();
+    // MIME type
+    header('Content-Type: application/json; charset=UTF-8');
+    // Disable content sniffing in browser
+    // This is needed in case we include HTML in JSON, browser might assume it's
+    // html to display
+    header('X-Content-Type-Options: nosniff');
+}
+
 /**
  * Outputs headers to prevent caching in browser (and on the way).
  *

libraries/display_import_ajax.lib.php

@@ -121,7 +121,7 @@ function PMA_Import_nopluginCheck()
   */
 function PMA_importAjaxStatus($id)
 {
-    header('Content-type: application/json');
+    PMA_headerJSON();
     echo json_encode(
         $_SESSION[$GLOBALS['SESSION_KEY']]['handler']::getUploadStatus($id)
     );

lint.php

@@ -31,7 +31,8 @@
 $sql_query = !empty($_POST['sql_query']) ? $_POST['sql_query'] : '';
 
 // Disabling standard response.
-$response = PMA_Response::getInstance();
-$response->disable();
+PMA_Response::getInstance()->disable();
+
+PMA_headerJSON();
 
 echo json_encode(PMA_Linter::lint($sql_query));

normalization.php

@@ -60,6 +60,8 @@
     $dependencies = json_decode($_REQUEST['pd']);
     $tables = json_decode($_REQUEST['tables']);
     $newTables = PMA_getHtmlForNewTables3NF($dependencies, $tables, $db);
+    PMA_Response::getInstance()->disable();
+    PMA_headerJSON();
     echo json_encode($newTables);
     exit;
 }

setup/validate.php

@@ -14,7 +14,7 @@
 $validators = array();
 require './libraries/config/Validator.class.php';
 
-header('Content-type: application/json');
+PMA_headerJSON();
 
 $ids = isset($_POST['id']) ? $_POST['id'] : null;
 $vids = explode(',', $ids);

version_check.php

@@ -13,7 +13,7 @@
 require_once 'libraries/VersionInformation.php';
 
 // Always send the correct headers
-header('Content-type: application/json; charset=UTF-8');
+PMA_headerJSON();
 
 $versionInformation = new VersionInformation();
 $versionDetails = $versionInformation->getLatestVersion();