Right now, if you try to download an attachment with content type @text/javascript@ with Redmine 3, it will be blocked by the CSRF protection of Rails. The user-visible response will be an HTTP 422.

This is because Rails thinks that these attachments are dynamic JavaScript resources and thus have to fall under the same origin policy. Unless the request is an AJAX (hxr) request, the downloads are blocked by the @verify_same_origin_request@ after filter which is part of the CSRF protection. This behavior was added to Rails 4.1 in https://github.com/rails/rails/pull/13345.

The attached patch excludes the @AttachmentController#download@ action from this protection, allowing to download javascript attachments. This change won't cause an XSS vulnerability in Redmine but technically allows a specific attack of external sites:

• Given the attacker (Mallory) knows the attachment download URL of a javascript attachment.
• Given a user (Alice) is logged in to Redmine in their browser with permission to download the attachment.
• If Mallory can trick Alice into visiting a Website which includes a @