From 8b45623e5ff6d48f67c1411fce1f31a07306b125 Mon Sep 17 00:00:00 2001 From: MAEDA Go Date: Tue, 4 Aug 2026 19:01:08 +0900 Subject: [PATCH 6/6] Send an attachment inline based on its detected content type instead of its file extension --- app/controllers/attachments_controller.rb | 4 ++-- test/functional/attachments_controller_test.rb | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/app/controllers/attachments_controller.rb b/app/controllers/attachments_controller.rb index ff436f90c..40cc78161 100644 --- a/app/controllers/attachments_controller.rb +++ b/app/controllers/attachments_controller.rb @@ -79,7 +79,7 @@ class AttachmentsController < ApplicationController end if stale?(:etag => @attachment.digest, :template => false) - # images are sent inline + # PDFs are sent inline send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename), :type => detect_content_type(@attachment), :disposition => disposition(@attachment) @@ -310,7 +310,7 @@ class AttachmentsController < ApplicationController end def disposition(attachment) - if attachment.is_pdf? + if detect_content_type(attachment) == 'application/pdf' 'inline' else 'attachment' diff --git a/test/functional/attachments_controller_test.rb b/test/functional/attachments_controller_test.rb index ab3f39d35..f2eefcb4a 100644 --- a/test/functional/attachments_controller_test.rb +++ b/test/functional/attachments_controller_test.rb @@ -391,6 +391,21 @@ class AttachmentsControllerTest < Redmine::ControllerTest assert_equal 'text/javascript', @response.media_type end + def test_download_should_not_send_a_non_pdf_file_inline_even_with_a_pdf_extension + set_tmp_attachments_directory + attachment = Attachment.create!( + :file => mock_file_with_options(:original_filename => 'fake.pdf', + :content => 'Hello'), + :author_id => 2, + :container => Issue.find(1) + ) + + get(:download, :params => {:id => attachment.id}) + assert_response :success + assert_equal 'text/html', @response.media_type + assert_match %r{\Aattachment}, @response.headers['Content-Disposition'] + end + def test_download_version_file_with_issue_tracking_disabled Project.find(1).disable_module! :issue_tracking get(:download, :params => {:id => 9}) -- 2.50.1