Since upgrading to 1.4 my users have noticed that attachments no longer open in internet explorer and I have confirmed this for myself.
All other known browsers have been tested and work the same as before. It's just IE which now won't open attachments but insists on downloading them instead.
Is this an already acknowledged change from 1.2 or something my users have discovered?
There was a security issue with opening attachments in the browser, so the 1.4.8 update made users download attachments.
Oh I see, thank you for the info, Joshua Mayer.
(2009-07-21, 09:42 AM)Joshua Mayer Wrote: [ -> ]There was a security issue with opening attachments in the browser, so the 1.4.8 update made users download attachments.
Should not have this been left up to the admin? I have a need to show Flash movies in a browser for education. When the environment is safe, allow the admin the option to play media within the browser.
Is there a workaround? I am the only one publishing Flash movie clips.
Caps
It shouldn't be left up to the admin and there shouldn't be a work around, this was done for security. If the change was undone, you, or your users, could be vulnerable to the issue that the change fixed. I believe it only happens with all attachments in IE so if you use another browser it might not happen.
(2009-07-21, 06:23 PM)MattRogowski Wrote: [ -> ]It shouldn't be left up to the admin and there shouldn't be a work around, this was done for security. If the change was undone, you, or your users, could be vulnerable to the issue that the change fixed. I believe it only happens with all attachments in IE so if you use another browser it might not happen.
Hi MattRogowski,
There are several options within the features of MyBB which carries warnings. If you are the site owner and admin/webmaster, you should be able to select options if you understand the risk. If you can not trust your admins, then why have them as admins.
Why then have any flash display within a browser? Why is IE any more prone to flash security risk than Opera or Firefox. Would it not be consistent to disable for all browsers?
I would appreciate a solution.
Thank you,
Caps
The problem was not with flash it was simply by opening the attachments directly in IE instead of bringing up the download box.
(2009-07-21, 06:51 PM)querschlaeger Wrote: [ -> ] (2009-07-21, 06:41 PM)Caps Wrote: [ -> ]I would appreciate a solution.
You could use the Shadowbox.js Plugin: http://mods.mybboard.net/view/shadowbox
It can handle/show attached and linked Flash animations too. 
Hi Querschlaeger,
I thank you soooooo much.
Caps
There's two separate issues;
1) Old versions of IE execute JavaScript in any type of file when they are shown in the browser, this makes all sort of mischief possible for anyone... all they have to do is attach a prepared file and get others to view it in IE. For security reasons, the browser has to be forced to download in this case.
2) MyBB has poor attachment / mime type handling, which causes attachments to be sent with the wrong mime types. This caused another security issue and currently there is a workaround in place for it that causes things to be downloaded instead of shown in the browser.
It's not possible to fix 1) since the issue is with IE (tell people to update their browser instead) but a better solution can be made for 2), especially so if it can be assumed that the board admin knows what he's doing (which is unfortunately not always the case and as far as I understood it this was also the reason why Ryan Gordon was reluctant on the solution I described to him).