From c0b68ccd53e7c718fd6197f85f885c1e182a421a Mon Sep 17 00:00:00 2001
From: Michael Telatynski <7t3chguy@gmail.com>
Date: Tue, 3 Mar 2020 13:23:33 +0000
Subject: [PATCH] only automatically download in usercontent if user requested
 it

---
 src/components/views/messages/MFileBody.js | 2 ++
 src/usercontent/index.js                   | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/components/views/messages/MFileBody.js b/src/components/views/messages/MFileBody.js
index 312346f412..125c538f82 100644
--- a/src/components/views/messages/MFileBody.js
+++ b/src/components/views/messages/MFileBody.js
@@ -271,6 +271,8 @@ export default createReactClass({
                     // We can't provide a Content-Disposition header like we would for HTTP.
                     download: fileName,
                     textContent: _t("Download %(text)s", { text: text }),
+                    // only auto-download if a user triggered this iframe explicitly
+                    auto: !this.props.decryptedBlob,
                 }, "*");
             };
 
diff --git a/src/usercontent/index.js b/src/usercontent/index.js
index 47eb83964f..2e87e182af 100644
--- a/src/usercontent/index.js
+++ b/src/usercontent/index.js
@@ -27,7 +27,10 @@ function remoteRender(event) {
     // Don't display scrollbars if the link takes more than one line to display.
     body.style = "margin: 0px; overflow: hidden";
     body.appendChild(a);
-    a.click(); // try to trigger download automatically
+
+    if (event.data.auto) {
+        a.click(); // try to trigger download automatically
+    }
 }
 
 function remoteSetTint(event) {