Details
-
Type: Bug
-
Status: Done/Fixed
-
Priority: Minor
-
Resolution: Fixed/Completed
-
Affects Version/s: 4.6.10
-
Fix Version/s: 4.7
-
Component/s: Core CiviCRM
-
Labels:
-
Documentation Required?:None
-
Funding Source:Contributed Code
Description
Contact images with .jpg file extension fail to display in Internet Explorer 10 and 11 with recent Drupal. A broken image graphic appears instead. Replicated on demo by uploading a .jpg file as a contact image and viewing the contact in IE11 on Windows 10.
We tracked this down to the recent addition in Drupal core of this HTTP header:
X-Content-Type-Options: nosniff
Without this header, the images load OK. The header was added for security reasons, see includes/bootstrap.inc:
// Prevent browsers from sniffing a response and picking a MIME type // different from the declared content-type, since that can lead to // XSS and other vulnerabilities. 'X-Content-Type-Options' => 'nosniff',
But why don't the images display correctly with this header? Because they are sent by Civi with the wrong content type:
Content-Type: image/jpg
This isn't valid: it should be image/jpeg. So IE is behaving correctly here, other browsers are being more lenient.
A simple fix in CRM/Contact/Page/ImageFile.php gets it working in 4.6.10. Looks like the code is similar enough that the same fix should work in master. Would be good to get the fix in 4.6 too.
PR wanted against master, I assume.