Bad content-type in response header when getting document can lead to html injection

How it was found

Bug

When request document by genesis_id or filename, the content-type field in response header is 'text/html'. And the document content can be anything. So if we upload an odt file with html format and share with other users, it can lead to html injection when others request that file.

PoC

• img1 via es_id
• img2 via filename (share with others)