Kai Burghardt is correct. Forcing a download is as simple as forgetting a content type header.
I'm a self-taught PHP coder and i've followed this thread. I agree that forced downloads of a plain text file is quite annoying. I'd also like to open a text file in a new window/tab. I do not have the source code to this forum, so it is a dificult shot to make. However, i have formulated a theory based upon examination of how the site is working from the client side perspective. I have seen the source code to phpbb, smf and two commercial packages (helping friends with code). Most of these forums are garbage PHP.
Not to get off track but may i vent for a moment? please? i've been banned from a few PHP forums in my early study days for the following reason: i got tired of being bullied and insulted and i stood up for myself and laid bare the truth: the bullies always refer to the weaving in-and-out of html and php as "spaghetti code". These php bullies will lecture newbies and slam down the mvc law and demand that PHP coders use symfony or laravel and class files for everything. Yet, if you examine their code closely, then you will see spaghetti code made from classes that is more spaghetti than an Italian guy with sauce in his mustache. id est, function that calls a function that calls a function that uses a built-in function to output text to the screen. You know, instead of using the caveman method of simply typing echo.
you will most likely know what i mean if you are an admin/moderator of this forum code and you have tried to track down attachment code. see what i mean? garbage PHP.
The actual attachment code is most likely broken up into several files in several places but i bet that you have an app file somewhere in the XF folder. My guess is to look for a folder named XF containing a file named App.php So probably forum_directory/src/XF/App.php
scroll though the App.php file looking for an array like the following that i found via online search:
Code:
$container['inlineImageTypes'] = function (Container $c) {
return [
'gif' => 'image/gif',
'jpg' => 'image/jpeg'
];
the associative array appears to hold header content-type data. You could add the following key/value pair to see if it changes from forced download to display (do not forget to use a comma after the last key/value pair so that the text handler can be added as the last key/value pair):
it is probably how the display is working anyway. Despite the fact that none of the key/value pairs are really being validated. Also, this 'patch' should work but then imaging a code-injection vulnerability... good lord!
