Adobe Acrobat JavaScript Execution Bug SC#346

2007-01-03 23:35:03 +00:00
parent c94eac4a4e
commit b8806cccdf
2 changed files with 11 additions and 0 deletions
@@ -255,6 +255,12 @@ function send_file($path, $filename, $lifetime=86400 , $filter=0, $pathisstring=
    $lastmodified = $pathisstring ? time() : filemtime($path);
    $filesize     = $pathisstring ? strlen($path) : filesize($path);

+    if ($mimetype=='application/pdf') {
+        //Adobe Reader XSS prevention - please note that it prevents opening of pdfs in browser
+        $mimetype = 'application/x-forcedownload';
+        $forcedownload = true;
+    }
+    
    //IE compatibiltiy HACK!
    if (ini_get('zlib.output_compression')) {
        ini_set('zlib.output_compression', 'Off');