MDL-47404 filelib: Prevent flash from treating files as uploads

added to send_stored_file as well.
roddle · Oct 1, 2014 · 9528f64 · 9528f64
1 parent 7f68cc6
commit 9528f64
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/lib/filelib.php b/lib/filelib.php
@@ -2448,7 +2448,10 @@ function send_stored_file($stored_file, $lifetime=null, $filter=0, $forcedownloa
 
     if ($forcedownload) {
         header('Content-Disposition: attachment; filename="'.$filename.'"');
-    } else {
+    } else if ($mimetype !== 'application/x-shockwave-flash') {
+        // If this is an swf don't pass content-disposition with filename as this makes the flash player treat the file
+        // as an upload and enforces security that may prevent the file from being loaded.
+
         header('Content-Disposition: inline; filename="'.$filename.'"');
     }