From 6b84a536e893ee0db109d467ffc1dbb96aa76685 Mon Sep 17 00:00:00 2001
From: Dan Marsden <dan@danmarsden.com>
Date: Wed, 1 Oct 2014 15:04:55 +1300
Subject: [PATCH] MDL-47404 filelib: Prevent flash from treating files as
 uploads added to send_stored_file as well.

---
 lib/filelib.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/filelib.php b/lib/filelib.php
index 1ba58e11c2e..d02f979c0a3 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -2448,7 +2448,10 @@ function send_stored_file($stored_file, $lifetime=null, $filter=0, $forcedownloa
 
     if ($forcedownload) {
         header('Content-Disposition: attachment; filename="'.$filename.'"');
-    } else {
+    } else if ($mimetype !== 'application/x-shockwave-flash') {
+        // If this is an swf don't pass content-disposition with filename as this makes the flash player treat the file
+        // as an upload and enforces security that may prevent the file from being loaded.
+
         header('Content-Disposition: inline; filename="'.$filename.'"');
     }