-
Bug
-
Resolution: Not a bug
-
Medium
-
None
-
5.1-OD-9
-
Fireball-220 Confluence 5.1-OD-8; Fireball-221 Confluence 5.1-OD-9
NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.
The current behavior (Confluence not allowing PDF files to be opened in the browser) is a side effect of a security improvement added to the product. As PDF files can be "active content", the behavior in Confluence will not be reverted.
Workarounds:
For Self-Hosted Instances
1. Click on cog at the Confluence header and choose "Confluence Admin"
2. Under "Users & Security" choose "Security Configuration".
3. Click any of the "Edit" buttons on the page and find the "Attachment Download Security Policy" section.
4. Select the "Insecure: Display all attachments inline" option and click "Save".
For OnDemand Instances
Create a Support ticket at http://support.atlassian.com requesting the change to be done in your instance.
- is duplicated by
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
- relates to
-
-
- Closed
-
- mentioned in
-
Wiki Page Failed to load
[CONFSERVER-29277] PDF files no longer open in browser, users are prompted to download.
Jay Miller
added a comment - How is it more secure to require users to download a PDF to their local machine and open the document? Isn't that equivalent in security (but less convenient) to opening it in the browser?
Jay Miller
added a comment - How is it more secure to require users to download a PDF to their local machine and open the document? Isn't that equivalent in security (but less convenient) to opening it in the browser? Hi All,
The current behavior (Confluence not allowing PDF files to be opened in the browser) is a side effect of a security improvement added to the product. As PDF files can be "active content", the behavior in Confluence will not be reverted.
Workarounds:
For Self-Hosted Instances
1. Click on cog at the Confluence header and choose "Confluence Admin"
2. Under "Users & Security" choose "Security Configuration".
3. Click any of the "Edit" buttons on the page and find the "Attachment Download Security Policy" section.
4. Select the "Insecure: Display all attachments inline" option and click "Save".
For OnDemand Instances
Create a Support ticket at http://support.atlassian.com requesting the change to be done in your instance.
Rina Nir
added a comment - Very annoying! I think this is almost a blocker. pleases fix! 
Michelle Benes
added a comment - Please fix this! It is a huge inconvenience to have to download pdfs before opening them.
Michelle Benes
added a comment - Please fix this! It is a huge inconvenience to have to download pdfs before opening them.
Opening PDF files in some browsers provides additional opportunities for cross-site scripting.