force download (#1002)

geocity/apps/accounts/views.py

@@ -26,7 +26,8 @@
     check_mandatory_2FA,
     permanent_user_required,
 )
-from geocity.fields import PrivateFileSystemStorage, PublicFileSystemStorage
+from geocity.apps.submissions import services
+from geocity.fields import PublicFileSystemStorage
 
 from . import forms, models
 from .users import is_2FA_mandatory
@@ -396,11 +397,8 @@ def administrative_entity_file_download(request, path):
     Only allows logged user to download administrative entity files
     """
 
-    mime_type, encoding = mimetypes.guess_type(path)
-    storage = PrivateFileSystemStorage()
-
     try:
-        return StreamingHttpResponse(storage.open(path), content_type=mime_type)
+        return services.download_file(path)
     except IOError:
         raise Http404
 

geocity/apps/submissions/services.py

@@ -315,10 +315,10 @@ def login_for_anonymous_request(request, entity):
 
 def download_file(path):
     storage = fields.PrivateFileSystemStorage()
-    # for some strange reason, firefox refuses to download the file.
-    # so we need to set the `Content-Type` to `application/octet-stream` so
-    # firefox will download it. For the time being, this "dirty" hack works
-    return FileResponse(storage.open(path), content_type="application/octet-stream")
+    # Force all files to be downloaded and never opened in browser on same domain
+    return FileResponse(
+        storage.open(path), content_type="application/octet-stream", as_attachment=True
+    )
 
 
 def download_archives(archive_ids, user):