Regression - PDFs download initiated on click (should be open in new tab)

zogstrip · June 10, 2026, 2:10pm

We were being inconsistent with the display type depending on whether you were using S3 or not. That should be fixed by

github.com/discourse/discourse

FIX: Serve inline-safe uploads inline on the local file store (#40739)

main ← fix-inline-safe-uploads-local-store

approved 05:17PM - 14 Jul 26 UTC

ZogStriP

+50 -61

Inline-safe uploads (images, PDFs, audio and video) served from the local file s…tore were sent with `Content-Disposition: attachment`, so clicking a PDF link downloaded the file instead of opening it in the browser. This was inconsistent with the S3 store, which already serves these files inline, and it left simple self-hosted (single-container, no S3/CDN) sites unable to open PDFs inline. `UploadsController#send_file_local_upload` only set the disposition to `attachment` for unsafe types, and to `inline` when `?inline=1` was passed, leaving it unset otherwise. Rails' `send_file` defaults an unset disposition to `attachment`, so inline-safe files fell through to a download. Inline-safe files are now served with `Content-Disposition: inline` by default, mirroring the S3 store, while unsafe types (HTML, SVG, XML, ...) and explicit downloads (`?dl=1`) keep the `attachment` disposition. The redundant `params[:inline]` branch is removed, since inline-safe files are now inline by default. The `Content-Security-Policy: sandbox;` header stays on **every** response as defense-in-depth: if the `is_inline_safe?` allowlist is ever wrong, the sandbox forces an opaque origin and disables script execution so a misclassified file cannot run as a document in our origin. It does not interfere with inline viewing — `sandbox` sandboxes scripts *inside* the served file, not the browser's native rendering of it. Chrome's built-in PDF viewer and Firefox's pdf.js both render sandboxed PDFs identically to unsandboxed ones, and images/audio/video decode natively regardless. A spec locks the allowlist invariant by asserting no inline-safe extension maps to a script-capable content type, so re-adding something like SVG or XML to the allowlist fails CI instead of becoming a stored XSS.

(cc @david)

The fact that clicking on a file opens automatically in another tab is more a product question.

Topic		Replies	Views
Make PDFs open directly (not via download) by default Feature completed , pdf-previews	15	874	February 18, 2026
Add configuration option to serve local PDF uploads inline Feature completed , pdf-previews	2	884	September 5, 2024
Discourse send PDF inline Plugin	11	1961	February 17, 2026
Make PDF previews actually readable Feature pdf-previews	7	344	July 14, 2026
Instead of downloading PDF, how to force PDF to open/view in browser only? Product Support	4	3677	March 5, 2023

Regression - PDFs download initiated on click (should be open in new tab)

Related topics