Index: /trunk/www/config.php
===================================================================
--- /trunk/www/config.php	(revision 922)
+++ /trunk/www/config.php	(revision 924)
@@ -79,4 +79,8 @@
                                     'inregistrare-runda', 'lista-inregistrare'),
                               $IA_DIRECT_CONTROLLERS);
 
+// List of safe MIME types
+// FIXME: add more?
+$IA_SAFE_MIME_TYPES = array('text/plain', 'image/jpeg', 'image/png', 'image/gif');
+
 ?>
Index: /trunk/www/controllers/attachment.php
===================================================================
--- /trunk/www/controllers/attachment.php	(revision 922)
+++ /trunk/www/controllers/attachment.php	(revision 924)
@@ -334,13 +334,22 @@
 }
 
 // download an attachment
-function controller_attachment_download($page_name, $file_name) {
+function controller_attachment_download($page_name, $file_name, $restrict_to_safe_mime_types = false) {
     // referer check
     if (http_referer_check()) {
         $attach = try_attachment_get($page_name, $file_name);
 
         // serve attachment with proper mime types
-        http_serve(attachment_get_filepath($attach), $file_name, $attach['mime_type']);
+        global $IA_SAFE_MIME_TYPES;
+        if (in_array($attach['mime_type'], $IA_SAFE_MIME_TYPES)) {
+            $mime_type = $attach['mime_type'];
+        } else {
+            if ($restrict_to_safe_mime_types) {
+                die_http_error(403, 'Permission denied');
+            }
+            $mime_type = "application/octet-stream";
+        }
+        http_serve(attachment_get_filepath($attach), $file_name, $mime_type);
     } else {
         // redirect to main page
         header("Location: " . url_absolute(url_home()));
Index: /trunk/www/controllers/image_attachment.php
===================================================================
--- /trunk/www/controllers/image_attachment.php	(revision 922)
+++ /trunk/www/controllers/image_attachment.php	(revision 924)
@@ -10,7 +10,7 @@
 function controller_attachment_resized_img($page_name, $file_name, $resize) {
     if (!$resize) {
         // no resize information: issue a regular file download
-        controller_attachment_download($page_name, $file_name);
+        controller_attachment_download($page_name, $file_name, true);
     }
 
     // check if image exists
Index: /trunk/www/index.php
===================================================================
--- /trunk/www/index.php	(revision 922)
+++ /trunk/www/index.php	(revision 924)
@@ -215,7 +215,7 @@
     } else {
         require_once(IA_ROOT_DIR.'www/controllers/attachment.php');
         // regular file download
-        controller_attachment_download($page, request('file'));
+        controller_attachment_download($page, request('file'), request('safe_only', false) == 'true');
     }
 }
 
Index: /trunk/www/url.php
===================================================================
--- /trunk/www/url.php	(revision 922)
+++ /trunk/www/url.php	(revision 924)
@@ -133,12 +133,13 @@
 
 // Textblock attachments:
 
-function url_attachment($page, $file) {
+function url_attachment($page, $file, $restrict_to_safe_mime_types = false) {
     log_assert(is_page_name($page));
     log_assert(is_attachment_name($file));
     return url_complex($page, array(
             'action' => 'download',
             'file' => $file,
+            'safe_only' => ($restrict_to_safe_mime_types ? 'true' : 'false'),
     ));
 }
 
@@ -174,7 +175,7 @@
                 'resize' => $resize,
         ));
     } else {
-        return url_attachment($page, $file);
+        return url_attachment($page, $file, true);
     }
 }
 
Index: /trunk/www/utilities.php
===================================================================
--- /trunk/www/utilities.php	(revision 922)
+++ /trunk/www/utilities.php	(revision 924)
@@ -86,16 +86,27 @@
 // NOTE: cache check enabled by default
 // WARNING: this function does not return
 function http_serve($disk_file_name, $http_file_name, $mime_type = null, $cache_check = true) {
-    // Cache magic.
-    if ($cache_check) {
-        http_cache_check(filemtime($disk_file_name));
+    if (is_null($mime_type)) {
+        $mime_type = "application/octet-stream";
     }
 
-    // HTTP headers.
-    if (!is_null($mime_type)) {
-        header("Content-Type: {$mime_type}");
+    global $IA_SAFE_MIME_TYPES;
+    if (!in_array($mime_type, $IA_SAFE_MIME_TYPES)) {
+        $disposition = "attachment";
+
+        // WARNING: *don't* add cache or the second time an attachment is downloaded in IE it will load inline
+    } else {
+        $disposition = "inline";
+
+        // Cache magic.
+        if ($cache_check) {
+            http_cache_check(filemtime($disk_file_name));
+        }
     }
-    header("Content-Disposition: inline; filename="
+
+    // HTTP headers.  
+    header("Content-Type: {$mime_type}");
+    header("Content-Disposition: {$disposition}; filename="
            .urlencode($http_file_name).";");
     $fsize = filesize($disk_file_name);
     header("Content-Length: " . $fsize);
