We should add "X-Content-Type-Options: nosniff" to our HTTP response headers via nginx in our "default config". This will help prevent someone uploading a .txt file that the browser interprets as an HTML file, etc (which could be used to initiate an XSS attack or etc).

​https://bugzilla.mozilla.org/show_bug.cgi?id=471020

We could probably add such support via:

​http://wiki.nginx.org/HttpHeadersModule

schendje came up with this good solution to having version numbers in the footer. It wouldn't be hard to implement. Attaching an image to explain, but basically hovering over "mediagoblin" should show the version number.

This should be easy to implement. The version number is already available in mediagoblin/mediagoblin/version.py ... import that, and insert it in mediagoblin.tools.template:get_jinja_env, where we have stuff like:

    # All templates will know how to ...
    # ... fetch all waiting messages and remove them from the queue
    # ... construct a grid of thumbnails or other media
    # ... have access to the global and app config
    template_env.globals['fetch_messages'] = messages.fetch_messages
    template_env.globals['gridify_list'] = gridify_list
    template_env.globals['gridify_cursor'] = gridify_cursor
    template_env.globals['app_config'] = mg_globals.app_config
    template_env.globals['global_config'] = mg_globals.global_config

This is an easy task, perfect for a new contributor.