From 8304343db33638a20eaf146577a3346a7c2fcca7 Mon Sep 17 00:00:00 2001
From: Ralf Lang <ralf.lang@ralf-lang.de>
Date: Mon, 11 May 2026 19:03:40 +0200
Subject: [PATCH] fix: Simplify Torben's previous PR on download URLs

This is papering over a bad AJAX response which we supposedly already fixed in backend.
Moreover the HTML parsing is brittle and opens new attack vectors.
---
 js/smartmobile.js | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/js/smartmobile.js b/js/smartmobile.js
index 2254c5507..7f32ba9cb 100644
--- a/js/smartmobile.js
+++ b/js/smartmobile.js
@@ -974,19 +974,13 @@ var ImpMobile = {
         var list = $('#imp-message-atclist').empty();
 
         $.each(ImpMobile.atc, function(k, v) {
-            var downloadUrl = v.download_url;
-            if (typeof downloadUrl !== 'string' || !downloadUrl.length || downloadUrl === '[object Object]') {
-                // Some backends serialize URL objects in AJAX payloads.
-                // Fallback: extract href from the rendered download link HTML.
-                downloadUrl = $('<div></div>').html(v.download || '').find('a').attr('href') || '';
-            }
-            if (!downloadUrl.length || downloadUrl === '[object Object]') {
+            var downloadUrl = String(v.download_url || '');
+            if (!downloadUrl.length) {
+                console.log('IMP smartmobile: attachment missing download_url', v);
                 return;
             }
             list.append(
                 $('<li class="imp-message-atc"></li>').append(
-                    // Attachments must bypass jQuery Mobile AJAX navigation so
-                    // binary responses (PDF, etc.) are handled as direct HTTP.
                     $('<a></a>').attr({
                         href: downloadUrl,
                         rel: 'external',