Skip to content

View online PDF inside the web browser by default

Reported by a user

If we avoid using Evince we can significantly decrease the attack vectors through PDFs.

A PDF opened in Iceweasel must (1) break through pdf.js to execute arbitrary JavaScript, but then (2) break Iceweasel itself to root your computer.

A PDF opened in Evince would have a much easier time breaking through. Evince and libpoppler are subject to significantly less attacks than Iceweasel, so Iceweasel is hardened and security conscious.

Related issues

Original created by @emmapeel on 7887 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information