In our current SharePoint 2010 solution, opening documents directly from the document-library works just fine, but when I click on the files through a CQWP, this doesn't work. Instead, the standard download-window appears.

Is there some way to make this work? Maybe by using a custom item-template in the ItemStyle.xsl?

I hope that someone can help me, I searched literally for hours on the net without success (obviously).

greetings, Markus.


This is not a CQWP issue, but a general security tightening of SP2010.

Since PDF files can embed JavaScript, they are prone to cross-side scripting attacks (XSS).

To mitigate this security threat they are not allowed to be opened in browser by default.

Yes you can disable this in two ways, the more secure and the less secure way. Please consider the threat issue and make an educated decision calculating the risk, instead of just blindly saying "we will never get a malicious PDF".

The less secure way to turn it off is setting browser file handling to Permissive. This works for all file types, so basicly any file type is treated the same.

The more secure way (the one i recommend) is to add the PDF mime-type to AllowedInlineDownloadedMimeTypes on the web application. You can do this in PowerShell:

$app = Get-SPWebApplication http://myWebApp

Again make sure you understand the security implications of what you are doing. The most secure way of handling this is to keep the default setting, thus not allowing XSS to exploit your current session.

Shout-out to Maurice Prather for this great article on the subject.

  • Thanks for the answer, but that doesn't answer my question. You see, the displaying of PDF-files in Browser is activated already. (this shouldn't be an security issue because this solution is our very own intranet) So it does work from the document-library and from list-webparts but not from CQWPs. – Markus Schwalbe May 11 '11 at 8:56
  • On the contrary Intranets is especially voulnerable since browser treats them as safe. It only takes one employee that by chance uploads an infected PDF from somewhere on the internet – Anders Rask May 11 '11 at 11:48

Apparently this is a known issue.

I've got two possible solutions for you.

1) Enable the "Open documents in client applications by default" site collection feature (from MSDN):


2) Modify the XSL to open the document in a new browser window (from the SharePoint Developer Team blog):



Duplicate question: Opening Word documents in CQWP in browser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.