# Make PDFs open directly (not via download) by default

**URL:** https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190
**Category:** Feature
**Tags:** completed, pdf-previews
**Created:** [11 בנובמבר,‏ 2025,‏ 9:39pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190 "2025-11-11T21:39:03Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [6 בפברואר,‏ 2026,‏ 5:17pm UTC](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190/12 "2026-02-06T17:17:14Z")

</div>

This should be resolved since [SECURITY: Download allowlist for uploaded files · discourse/discourse@9c0642a · GitHub](https://github.com/discourse/discourse/commit/9c0642a2e79040a140b99601296cb10cf425eb9f)

We now have centralised logic to determine which files should be shown ‘inline’. That means that PDFs are consistently shown inline, and some less safe file types are consistently served as downloads. These changes should work on all types of upload storage (local & S3, with or without CDNs).

---

_[View the full topic](https://meta.discourse.org/t/make-pdfs-open-directly-not-via-download-by-default/388190)._