| The content disposition of the attachments of XWiki is controlled by a couple of configurations, that will determine whether the file is sent as an inline content, leaving the browser handle it (open or download, depending on what it knows to do) or as an attachment content, forcing the browser to download it. These are configured in https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HSecurity. The pdf mimetype is not in the default list of whitelisted attachment types, which results in pdf files being always proposed for download, in absence of a custom configuration. There is fundamentally no good reason for this protection by default, the browser should ensure security of the pdf files it handles . We should add the pdf mimetype in the default list of whitelisted attachment types. |
