From 1f701bbced22af077503f69f96c9a04d95cf92d1 Mon Sep 17 00:00:00 2001
From: Carlos Ruiz <carg67@gmail.com>
Date: Mon, 10 Jun 2019 15:08:00 +0200
Subject: [PATCH] IDEMPIERE-3980 Thanks to Alessandro Cordella for reporting

---
 .../WEB-INF/src/org/adempiere/webui/panel/WAttachment.java    | 1 +
 .../WEB-INF/src/org/adempiere/webui/window/WMediaDialog.java  | 2 ++
 org.adempiere.ui.zk/WEB-INF/web.xml                           | 4 ++++
 3 files changed, 7 insertions(+)

diff --git a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/panel/WAttachment.java b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/panel/WAttachment.java
index c6c69854d6..ae18b97904 100644
--- a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/panel/WAttachment.java
+++ b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/panel/WAttachment.java
@@ -482,6 +482,7 @@ public class WAttachment extends Window implements EventListener<Event>
 				AMedia media = new AMedia(entry.getName(), null, contentType, entry.getData());
 
 				preview.setContent(media);
+				preview.setClientAttribute("sandbox", "");
 				preview.setVisible(true);
 				preview.invalidate();
 			}
diff --git a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/window/WMediaDialog.java b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/window/WMediaDialog.java
index 85e3c6fc14..b8ec742919 100644
--- a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/window/WMediaDialog.java
+++ b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/window/WMediaDialog.java
@@ -237,7 +237,9 @@ public class WMediaDialog extends Window implements EventListener<Event>
 				AMedia media = createMedia();
 				
 				preview.setContent(media);
+				preview.setClientAttribute("sandbox", "");
 				preview.setVisible(true);
+				preview.invalidate();
 			}
 			catch (Exception e)
 			{
diff --git a/org.adempiere.ui.zk/WEB-INF/web.xml b/org.adempiere.ui.zk/WEB-INF/web.xml
index 15898c060e..3f001c5015 100644
--- a/org.adempiere.ui.zk/WEB-INF/web.xml
+++ b/org.adempiere.ui.zk/WEB-INF/web.xml
@@ -85,6 +85,10 @@
 	<!-- /////////// -->
 	<!-- Miscellaneous -->
 	<session-config>
+		<cookie-config>
+                        <http-only>true</http-only>
+                        <secure>true</secure>
+                </cookie-config>
 		<session-timeout>60</session-timeout>
 	</session-config>