fix(security): headers were not applied to uploads

Due to express static overriding the response, applying the extra headers
like CSP and Content-Disposition did not work for files served under the
/uploads route. By reordering, the code this works now.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

app.js

@@ -156,6 +156,13 @@ app.use(cookieParser())
 app.use(i18n.init)
 
 // routes without sessions
+// security headers for uploads
+app.use('/uploads', (req, res, next) => {
+  res.set('Content-Disposition', 'attachment')
+  res.set('Content-Security-Policy', "default-src 'none'")
+  next()
+})
+
 // static files
 app.use('/', express.static(path.join(__dirname, '/public'), {
   maxAge: config.staticCacheTime,
@@ -166,13 +173,6 @@ app.use('/docs', express.static(path.resolve(__dirname, config.docsPath), {
   maxAge: config.staticCacheTime,
   redirect: false
 }))
-// This is done by an additional middleware, instead of setHeaders of express.static, because for what ever reason
-// the latter did not work
-app.use('/uploads', (req, res, next) => {
-  res.set('Content-Disposition', 'attachment')
-  res.set('Content-Security-Policy', "default-src 'none'")
-  next()
-})
 app.use('/uploads', express.static(path.resolve(__dirname, config.uploadsPath), {
   maxAge: config.staticCacheTime,
   redirect: false