How to open documents in browser from a ContentByQueryWebPart (SP2010)

Question

In our current SharePoint 2010 solution, opening documents directly from the document-library works just fine, but when I click on the files through a CQWP, this doesn't work. Instead, the standard download-window appears.

Is there some way to make this work? Maybe by using a custom item-template in the ItemStyle.xsl?

I hope that someone can help me, I searched literally for hours on the net without success (obviously).

greetings, Markus.

Answer 1

This is not a CQWP issue, but a general security tightening of SP2010.

Since PDF files can embed JavaScript, they are prone to cross-side scripting attacks (XSS).

To mitigate this security threat they are not allowed to be opened in browser by default.

Yes you can disable this in two ways, the more secure and the less secure way. Please consider the threat issue and make an educated decision calculating the risk, instead of just blindly saying "we will never get a malicious PDF".

The less secure way to turn it off is setting browser file handling to Permissive. This works for all file types, so basicly any file type is treated the same.

The more secure way (the one i recommend) is to add the PDF mime-type to AllowedInlineDownloadedMimeTypes on the web application. You can do this in PowerShell:

$app = Get-SPWebApplication http://myWebApp
$app.AllowedInlineDownloadedMimeTypes.add("application/pdf")
$app.Update()

Again make sure you understand the security implications of what you are doing. The most secure way of handling this is to keep the default setting, thus not allowing XSS to exploit your current session.

Shout-out to Maurice Prather for this great article on the subject.

Answer 2

Apparently this is a known issue.

I've got two possible solutions for you.

1) Enable the "Open documents in client applications by default" site collection feature (from MSDN):

http://social.msdn.microsoft.com/Forums/en/sharepointgeneralprevious/thread/90d251c3-43d4-4b05-b87c-7c25bb32a782

2) Modify the XSL to open the document in a new browser window (from the SharePoint Developer Team blog):

http://blogs.technet.com/b/sharepointdevelopersupport/archive/2012/07/24/how-to-open-content-query-web-part-links-in-a-new-ie-window.aspx

Note:

Duplicate question: Opening Word documents in CQWP in browser