...

create a "pdf icon" only when the implementation of the external.png is

How do you want to detect whether an URL points to a PDF-file (i. e. not something that Internet Exlporer would executeable but is called "something.pdf") Hendrik

Hendrik,

as the subject says: I only propose to show an icon, I did not propose to scan file types of something extern. If that file is internal i.e. linked via the [[media:filename.pdf]] notation, then the server has potentially the chance to check the "magic" byte of that file; if it is external, i.e. [http://server/filename.pdf%7Cothername], you can only argue from the filename.pdf that it pretends to be "PDF" . If you see a security problem, what does the (PDF.png vs. external.png ?) icon change in this respect ?

Nothing; but with my proposal you could even have ***two*** different PDF icons, a green "secure" icon for internal (filetype scanned) [[media:filename.pdf]] files and a red "insecure" alerting one ("extern; probably PDF") for the others. This is just meant as an ad-hoc proposal to show you the positive possibilities of my proposal.

Does this answer satisfy you ?

Tom