Security patch released 20210518

[h2o]

@tmassman

The problem is that with this patch we a) decrease the user experience — e.g. PDFs can not be viewed in the browser anymore, they have to be downloaded (and the downloaded PDF might be viewed in the browser, but not the online version)

A client reported the same issue yesterday. The portal is a Plone 4.3 site. Some PDF files using @@display-view will cause a download. Others display on the browser. What I have noticed is that files that resulted in a download had the extra header:

content-disposition: attachment; filename="some.pdf"

@mauritsvanrees

PDF seems safe to add there yes. A patch in your own code could work, something like this (untested):

from Products.PloneHotfix20210518 import namedfile
namedfile.ALLOWED_INLINE_MIMETYPES.append("application/pdf")

The above resolved the issue and PDF files now display inline instead of being downloaded.

[jensens (Jens W. Klein)]

@mauritsvanrees

from Products.PloneHotfix20210518 import namedfile
namedfile.ALLOWED_INLINE_MIMETYPES.append("application/pdf")

Same here, I had a customer complaining about PDF downloads. The above lines are fixing it.

[mauritsvanrees]

Technically, PDFs could be vulnerable too. See https://owasp.org/www-pdf-archive/OWASP_IL_The_Universal_XSS_PDF_Vulnerability.pdf
But that was a bug when 􏰀Adobe Acrobat Reader was used to view the PDF in the browser, and this program has meanwhile been patched. I don't see when this was though.

I do wonder about changing the hotfix to optionally use a short blacklist instead of the current whitelist, triggered by an OS environment variable. Would that help?

Blacklist would be:

application/javascript
application/x-javascript
text/javascript
text/html
image/svg+xml
image/svg+xml-compressed

I hope we have them all then... I have these from http://localhost:8080/Plone/mimetypes_registry/manage_main

[mauritsvanrees]

@mauritsvanrees

You are right. I didn't realise that the hotfix would make the inline diff and code diff that much alike. Well, there are still differences, but with the hotfix the inline diff shows html code, so it has gotten uglier.

Here is the PR for merging the hotfix into Products.CMFDiffTool. After this is merged, someone could try to improve it.

I have a PR to improve this and use the safe html transform for the inline diff of rich text fields:

Fix inline diff for rich text fields after PloneHotfix20210518.

I may add that to a new version of the hotfix as well.

[jensens (Jens W. Klein)]

@mauritsvanrees

By popular request, allow showing PDF files inline.