From 9c49307f5c2f5a67ab5b3b1270cc83b30efa8637 Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Mon, 2 Feb 2009 19:10:32 +0000
Subject: Bug 472206: [SECURITY] Bugzilla should optionally not allow the user
 to view possibly harmful attachments - Patch by Frédéric Buclin
 <LpSolit@gmail.com> r=mkanat r=justdave a=LpSolit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 attachment.cgi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'attachment.cgi')

diff --git a/attachment.cgi b/attachment.cgi
index f1753261d..16615abae 100755
--- a/attachment.cgi
+++ b/attachment.cgi
@@ -332,8 +332,10 @@ sub view {
     $filename =~ s/\\/\\\\/g; # escape backslashes
     $filename =~ s/"/\\"/g; # escape quotes
 
+    my $disposition = Bugzilla->params->{'allow_attachment_display'} ? 'inline' : 'attachment';
+
     print $cgi->header(-type=>"$contenttype; name=\"$filename\"",
-                       -content_disposition=> "inline; filename=\"$filename\"",
+                       -content_disposition=> "$disposition; filename=\"$filename\"",
                        -content_length => $attachment->datasize);
     disable_utf8();
     print $attachment->data;
-- 
cgit v1.2.3-24-g4f1b