From 68406d778ceaaab88ddf775ab742caffb6d8ad0f Mon Sep 17 00:00:00 2001 From: Dan Marsden Date: Wed, 24 Sep 2014 22:39:53 +1200 Subject: [PATCH] MDL-47404 filelib: Prevent flash from treating files as uploads Flash treats files as uploads if filename is passed in content-disposition this causes security to be enforced that causes issues with SCORM packages --- lib/filelib.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/filelib.php b/lib/filelib.php index bc55e11c03b..e69825f47a7 100644 --- a/lib/filelib.php +++ b/lib/filelib.php @@ -2273,7 +2273,10 @@ function send_file($path, $filename, $lifetime = null , $filter=0, $pathisstring if ($forcedownload) { header('Content-Disposition: attachment; filename="'.$filename.'"'); - } else { + } else if ($mimetype !== 'application/x-shockwave-flash') { + // If this is an swf don't pass content-disposition with filename as this makes the flash player treat the file + // as an upload and enforces security that may prevent the file from being loaded. + header('Content-Disposition: inline; filename="'.$filename.'"'); }