486685 - MIME type override for attachments lost in HTTP redirect

Status: RESOLVED FIXED

(Bugzilla :: Attachments & Requests, defect)

Description

[Alex Vincent [:WeirdAl]]

Steps to reproduce:
(1) Try to load the URL field in this bug.

Expected results:
User gets a download file dialog.

Actual results:
User sees the attachment in their browser.

Test session with wget:
$ wget http://bugzilla.mozilla.org/attachment.cgi?id=342678&content_type=text/plain
[1] 4996

Alex Vincent@VISTA64 /c/tests
$ --08:10:25--  http://bugzilla.mozilla.org/attachment.cgi?id=342678
           => `attachment.cgi@id=342678'
Resolving bugzilla.mozilla.org... 63.245.209.72
Connecting to bugzilla.mozilla.org|63.245.209.72|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://bugzilla.mozilla.org/attachment.cgi?id=342678 [following]

Note the content_type flag has been lost in the HTTP redirect

Comment 1

[Max Kanat-Alexander]

I wasn't even aware there was such a redirect...

Comment 2

[Max Kanat-Alexander]

I mean, I wasn't aware there was such an override.

Comment 3

[Frédéric Buclin]

Attachment: patch, v1

Comment 4

[Frédéric Buclin]

I will take this fix on the 3.0 branch as I regressed this feature there too.

Comment 5

[Teemu Mannermaa (:wicked)]

Comment on attachment 371233 [details] [diff] [review]
patch, v1

This does fix the reported case for the content_type parameter for all four branches.

I couldn't find any other parameters that would need to survive through this redirect. Although, this could have been future proofed by using all current query parameters passed and only add new ones when constructing the redirection URL. See sub redirect_to_urlbase in Bugzilla/CGI.pm how this could be done quite easily.

Comment 6

[Max Kanat-Alexander]

Comment on attachment 371233 [details] [diff] [review]
patch, v1

Why not just pass on any extra query string variables?

Comment 7

[Frédéric Buclin]

(In reply to comment #6)
> Why not just pass on any extra query string variables?

Because I want to avoid any abuse. No other variable is usable/valid when viewing attachments.

Comment 8

[Frédéric Buclin]

tip:

Checking in attachment.cgi;
/cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v  <--  attachment.cgi
new revision: 1.156; previous revision: 1.155
done

3.3.4:

Checking in attachment.cgi;
/cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v  <--  attachment.cgi
new revision: 1.153.2.1; previous revision: 1.153
done

3.2.3:

Checking in attachment.cgi;
/cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v  <--  attachment.cgi
new revision: 1.144.2.6; previous revision: 1.144.2.5
done

3.0.8:

Checking in attachment.cgi;
/cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v  <--  attachment.cgi
new revision: 1.126.2.4; previous revision: 1.126.2.3
done

Comment 9

[Dave Miller [:justdave]]

For those who ran into this on bmo, this fix has been deployed to the production servers.