Bugzilla – Attachment 195226 Details for
Bug 42080
Invoice PDFs are forced downloads
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 42080: Invoice PDFs are forced downloads
Bug-42080-Invoice-PDFs-are-forced-downloads.patch (text/plain), 1.42 KB, created by
Eric Phetteplace
on 2026-03-12 20:49:06 UTC
(
hide
)
Description:
Bug 42080: Invoice PDFs are forced downloads
Filename:
MIME Type:
Creator:
Eric Phetteplace
Created:
2026-03-12 20:49:06 UTC
Size:
1.42 KB
patch
obsolete
>From 2b1bb3835f3fae835e473a158055f8b492a51856 Mon Sep 17 00:00:00 2001 >From: Eric Phetteplace <ephetteplace@cca.edu> >Date: Thu, 12 Mar 2026 13:47:50 -0700 >Subject: [PATCH] Bug 42080: Invoice PDFs are forced downloads > >Serve invoice files with a CSP header that prevents XSS >instead of with an attachment header that turns them into >downloads. > >Testing plan: >- Set AcqEnableFiles preference to Do >- Acquisitions > Vendor > Receive Shipment > Create invoice >- Finish Receiving > Manage invoice files >- Upload an SVG with a <script> tag in it >- Click the SVG filename to open it >- Inspect browser's console: it should say something about a >script being blocked due to the CSP directive >--- > acqui/invoice-files.pl | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > >diff --git a/acqui/invoice-files.pl b/acqui/invoice-files.pl >index 39ab34d51e..34b99f3b89 100755 >--- a/acqui/invoice-files.pl >+++ b/acqui/invoice-files.pl >@@ -59,9 +59,9 @@ if ( $op eq 'download' ) { > my $fname = $file->{'file_name'}; > my $ftype = $file->{'file_type'}; > print $input->header( >- -type => $file->{'file_type'}, >- -charset => 'utf-8', >- -attachment => $file->{'file_name'} >+ -type => $file->{'file_type'}, >+ -charset => 'utf-8', >+ 'Content-Security-Policy' => "default-src 'none'; script-src 'none';" > ); > print $file->{'file_content'}; > } else { >-- >2.53.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 42080
:
195226
|
195245
|
195246