From b4452ff1dadd2f3d45bec8bff6dbe34094ecdb93 Mon Sep 17 00:00:00 2001
From: Antoine Abt <antoine@abt.im>
Date: Fri, 17 Dec 2021 11:10:54 +0100
Subject: [PATCH] fix: security - force attachment download

---
 c2cgeoform/templates/widgets/readonly/file_upload.pt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/c2cgeoform/templates/widgets/readonly/file_upload.pt b/c2cgeoform/templates/widgets/readonly/file_upload.pt
index d7874c95..c70d582c 100644
--- a/c2cgeoform/templates/widgets/readonly/file_upload.pt
+++ b/c2cgeoform/templates/widgets/readonly/file_upload.pt
@@ -1,3 +1,3 @@
 <p id="${oid|field.oid}" class="form-control-static deform-readonly-text">
-  <a href="${url}" tal:omit-tag="not:url" tal:content="cstruct.get('filename') or ''"></a>
+  <a href="${url}" download="${cstruct.get('filename') or ''}" tal:omit-tag="not:url" tal:content="cstruct.get('filename') or ''"></a>
 </p>