Display files inline

Overview

Configure Files to display files inline instead of as attachments. Useful for displaying active content, such as Adobe Flash (.swf) files, on the HTML pages. We enable inline display by changing a configuration property in files-config.xml. Set the inline parameter to true in the download requests.

By default, the Connections server passes Files application files to browsers with the header "Content-Disposition: attachment." This means files display as attachments; when users click the attachment they are prompted to open or download the file. It also prevents embedding files. To embed files in our own HTML page using an <embed> tag, the content disposition must be inline. This affects active content, such as Adobe Flash (.swf), and HTML pages referenced with <iframe>.

Files uses the attachment disposition for security reasons. Uploaded files could potentially contain malicious code that can exploit the cross-site scripting vulnerabilities of some browsers. If you switch to inline disposition, for greater security, configure an alternate domain download.

Change the content disposition to inline

1. Check out the Files configuration files:
   ./wsadmin.sh -lang jython
   execfile("filesAdmin.py")
   FilesConfigService.checkOutConfig("/tmp", "cell_name")

   To get cell name...

   print AdminControl.getCell()

2. Change the content disposition to inline:
   FilesConfigService.updateConfig("security.inlineDownload.enabled", "true")

3. After making changes, check the configuration files back during the same wsadmin session in which they were checked out.

4. Set the inline parameter to true in the download requests...
   http://host:port/files/form/anonymous/api/library/library_ID/document/file_ID/media/FileName.ext?inline=true

Parent topic:
Administer Files

Related:
Apply Files property changes
Mitigate a cross site scripting attack
Files configuration properties