회귀 문제 - PDF 다운로드가 클릭 시 시작됨 (새 탭에서 열어야 함)

zogstrip · 6월 10, 2026, 2:10오후

S3를 사용하는지에 따라 display 타입 처리가 일관되지 않았습니다. 이 문제는

github.com/discourse/discourse

FIX: Serve inline-safe uploads inline on the local file store (#40739)

main ← fix-inline-safe-uploads-local-store

merged 05:52PM - 14 Jul 26 UTC

ZogStriP

+50 -61

Inline-safe uploads (images, PDFs, audio and video) served from the local file s…tore were sent with `Content-Disposition: attachment`, so clicking a PDF link downloaded the file instead of opening it in the browser. This was inconsistent with the S3 store, which already serves these files inline, and it left simple self-hosted (single-container, no S3/CDN) sites unable to open PDFs inline. `UploadsController#send_file_local_upload` only set the disposition to `attachment` for unsafe types, and to `inline` when `?inline=1` was passed, leaving it unset otherwise. Rails' `send_file` defaults an unset disposition to `attachment`, so inline-safe files fell through to a download. Inline-safe files are now served with `Content-Disposition: inline` by default, mirroring the S3 store, while unsafe types (HTML, SVG, XML, ...) and explicit downloads (`?dl=1`) keep the `attachment` disposition. The redundant `params[:inline]` branch is removed, since inline-safe files are now inline by default. The `Content-Security-Policy: sandbox;` header stays on **every** response as defense-in-depth: if the `is_inline_safe?` allowlist is ever wrong, the sandbox forces an opaque origin and disables script execution so a misclassified file cannot run as a document in our origin. It does not interfere with inline viewing — `sandbox` sandboxes scripts *inside* the served file, not the browser's native rendering of it. Chrome's built-in PDF viewer and Firefox's pdf.js both render sandboxed PDFs identically to unsandboxed ones, and images/audio/video decode natively regardless. A spec locks the allowlist invariant by asserting no inline-safe extension maps to a script-capable content type, so re-adding something like SVG or XML to the allowlist fails CI instead of becoming a stored XSS.

을 통해 수정되어야 합니다.

(cc @david)

파일을 클릭하면 자동으로 새 탭에서 열리는 것은 더 많은 product 관련 질문입니다.

글		댓글	조회수
Make PDFs open directly (not via download) by default Feature completed , pdf-previews	15	656	2월 18, 2026
Add configuration option to serve local PDF uploads inline Feature completed , pdf-previews	2	820	9월 5, 2024
Discourse send PDF inline Plugin	11	1747	2월 17, 2026
Make PDF previews actually readable Feature pdf-previews	7	250	7월 14, 2026
Instead of downloading PDF, how to force PDF to open/view in browser only? Support	4	3602	3월 5, 2023

회귀 문제 - PDF 다운로드가 클릭 시 시작됨 (새 탭에서 열어야 함)

Related topics