Only allow image attachments to be opened in the browser window #3920

include/class.http.php

@@ -106,7 +106,7 @@ class Http {
     }
 
     function download($filename, $type, $data=null, $disposition='attachment') {
-        if (strpos($type, 'image/') !== 0 || preg_match('/image\/.*\+.*/', $type))
+        if (strpos($type, 'image/') !== false && preg_match('/image\/.*\+.*/', $type))
           $disposition='attachment';
 
         header('Pragma: private');