separate download url from preview url

css/base.css

@@ -1714,7 +1714,7 @@ ul.tabbar li.active > a:after {
   margin: 0.35rem;
   width: 6rem;
   border-radius: 0.1rem;
-  background-color: silver;
+  background-color: #cfd8dc;
 }
 /* Colored uploader progress bar of variable length */
 .uploader > div > span {

drafty.js

@@ -129,7 +129,8 @@ Sample JSON representation of the text above:
     },
     IM: {
       open: function(data) {
-        var previewUrl = data.val ? base64toObjectUrl(data.val, data.mime) : data.ref;
+        // Don't use data.ref for preview: it's a security risk. 
+        var previewUrl = base64toObjectUrl(data.val, data.mime);
         var downloadUrl = data.ref ? data.ref : previewUrl;
         var res = (data.name ? '<a href="' + downloadUrl + '" download="' + data.name + '">' : '') +
           '<img src="' + previewUrl + '"' +
@@ -737,11 +738,22 @@ Sample JSON representation of the text above:
       },
 
       /**
-       * Get blob URL for a given entity.
+       * Given the entity, get URL which can be used for downloading
+       * entity data.
        *
        * @param {Object} entity to get the URl from.
        */
-      getBlobUrl: function(entity) {
+      getDownloadUrl: function(entity) {
+        return entity.ref ? entity.ref : base64toObjectUrl(entity.val, entity.mime);
+      },
+
+      /**
+       * Given the entity, get URL which can be used for previewing
+       * the entity.
+       *
+       * @param {Object} entity to get the URl from.
+       */
+      getPreviewUrl: function(entity) {
         return base64toObjectUrl(entity.val, entity.mime);
       },
 

index.html

@@ -3176,7 +3176,7 @@
         if (this.props.mimeType === Drafty.getContentType()) {
           Drafty.attachments(content, function(att, i) {
             attachments.push(<Message.Attachment
-              filename={att.name} blobUrl={Drafty.getBlobUrl(att)}
+              filename={att.name} downloadUrl={Drafty.getDownloadUrl(att)}
               size={Drafty.getEntitySize(att)} key={i} />);
           }, this);
           content = React.createElement('span', null, Drafty.format(content, formatter, this));
@@ -3283,7 +3283,7 @@
               {this.props.uploader ?
                 <FileUploadProgress progress={this.props.progress} />
                 :
-                <div><a href={this.props.blobUrl} download={this.props.filename}>
+                <div><a href={this.props.downloadUrl} download={this.props.filename}>
                   <i className="material-icons">file_download</i> save
                 </a></div>
               }