回归问题 - PDF 点击后开始下载（应在新标签页打开）

zogstrip · 2026年六月10日 14:10

我们之前在使用 S3 与否的情况下，对 display 类型的处理不一致。这应该已通过以下链接修复：

github.com/discourse/discourse

FIX: Serve inline-safe uploads inline on the local file store (#40739)

main ← fix-inline-safe-uploads-local-store

approved 05:17PM - 14 Jul 26 UTC

ZogStriP

+50 -61

Inline-safe uploads (images, PDFs, audio and video) served from the local file s…tore were sent with `Content-Disposition: attachment`, so clicking a PDF link downloaded the file instead of opening it in the browser. This was inconsistent with the S3 store, which already serves these files inline, and it left simple self-hosted (single-container, no S3/CDN) sites unable to open PDFs inline. `UploadsController#send_file_local_upload` only set the disposition to `attachment` for unsafe types, and to `inline` when `?inline=1` was passed, leaving it unset otherwise. Rails' `send_file` defaults an unset disposition to `attachment`, so inline-safe files fell through to a download. Inline-safe files are now served with `Content-Disposition: inline` by default, mirroring the S3 store, while unsafe types (HTML, SVG, XML, ...) and explicit downloads (`?dl=1`) keep the `attachment` disposition. The redundant `params[:inline]` branch is removed, since inline-safe files are now inline by default. The `Content-Security-Policy: sandbox;` header stays on **every** response as defense-in-depth: if the `is_inline_safe?` allowlist is ever wrong, the sandbox forces an opaque origin and disables script execution so a misclassified file cannot run as a document in our origin. It does not interfere with inline viewing — `sandbox` sandboxes scripts *inside* the served file, not the browser's native rendering of it. Chrome's built-in PDF viewer and Firefox's pdf.js both render sandboxed PDFs identically to unsandboxed ones, and images/audio/video decode natively regardless. A spec locks the allowlist invariant by asserting no inline-safe extension maps to a script-capable content type, so re-adding something like SVG or XML to the allowlist fails CI instead of becoming a stored XSS.

（抄送 @david）

点击文件后在新标签页中自动打开，这更多是一个产品问题。

話題		回覆	觀看
Make PDFs open directly (not via download) by default Feature completed , pdf-previews	15	718	2026年二月18日
Add configuration option to serve local PDF uploads inline Feature completed , pdf-previews	2	840	2024年九月5日
Discourse send PDF inline Plugin	11	1806	2026年二月17日
Make PDF previews actually readable Feature pdf-previews	7	282	2026年七月14日
Instead of downloading PDF, how to force PDF to open/view in browser only? Support	4	3625	2023年三月5日

回归问题 - PDF 点击后开始下载（应在新标签页打开）

相關主題