Image attachments download instead of being viewed in the browser
Created by: bobrovnikov
As far as I remember, images attached to the posts were available to see inside browser window, when the link opened with target="_blank". However, after recent updates images are downloaded instead of being viewed directly. And this type of behaviour is rather inconvenient. Is there any config I can change to fix this?
Activity
Created by: Wachiwi
Cannot confirm this. Everything works fine for me (Gitlab 7.1.1, installed by source). Maybe it occurs through the browser configuration/usage?
By Administrator on 2014-08-08T08:42:26 (imported from GitLab project)
By Administrator on 2014-08-08T08:42:26 (imported from GitLab)
Created by: cirosantilli
+1. We still have
target="blank"on the HTML, I think the problem comes fromContent-disposition: attachmentis being sent.Note however that doing this is dangerous on certain browsers / plugins: http://security.stackexchange.com/questions/11756/is-it-safe-to-serve-any-user-uploaded-file-under-only-white-listed-mime-content, the only real solution being to use a separate domain like github does.
Similar consideration goes for GitLab's raw, which currently does not show images because it forces
Content-Type: application/octet-streamon non text.By Administrator on 2014-11-08T11:32:46 (imported from GitLab project)
By Administrator on 2014-11-08T11:32:46 (imported from GitLab)
Created by: cirosantilli
On the other hand, it is currently possible to get direct viewable image URLs for issue attachments and for avatars, so if there is a vulnerability there, we are vulnerable.
By Administrator on 2014-11-10T12:26:37 (imported from GitLab project)
By Administrator on 2014-11-10T12:26:37 (imported from GitLab)
Created by: Razer6
Implemented with https://github.com/gitlabhq/gitlabhq/commit/0a9cab4ee65f2b42c56989698c401cab60d68b53
By Administrator on 2015-02-06T19:18:29 (imported from GitLab project)
By Administrator on 2015-02-06T19:18:29 (imported from GitLab)
