Whereas in Issuezilla most attachments could be displayed inline in the browser, Bugzilla now sends

  Content-disposition: attachment; filename="stacktrace.txt"
  Content-length: 6430
  Content-Type: text/plain; name="stacktrace.txt"; charset=UTF-8

which forces the file to be downloaded; there is no way to view it directly in the browser. (The Greasemonkey script to display attachments inline cannot be made to work either.) This is a major regression in day-to-day workflow; for example, to view a screenshot of a bug, you need to click the link, figure out where your browser saved the file, then manually launch an image viewer program on that path.

Was this change of behavior intentional, say for security reasons? I see in BZ sources

    my $disposition = Bugzilla->params->{'allow_attachment_display'} ? 'inline' : 'attachment';

    print $cgi->header(-type=>"$contenttype; name=\"$filename\"",
                       -content_disposition=> "$disposition; filename=\"$filename\"",
                       -content_length => $attachment->datasize);

implying that it is a global parameter, I guess edited here:

https://netbeans.org/bugzilla/editparams.cgi