### Before filing a report

_Before you file a report, please ensure you are running the latest version of OpenProject and_ 
_have searched for similar bug reports._

### Steps to reproduce

1. Login as a user with permissions to manage members in project Operations

2. Go to the daily reports wiki

3. Click HTML report link


### What is the buggy behavior?

* The link opens the HTML document as raw text in a new tab as shown. Begin of the insertion

<br>

End of the insertion Begin of the deletion
End of the deletion <img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/231018/content">


### What is the expected behavior?

Begin of the insertion* End of the insertion Begin of the deletion 1. End of the deletion The links Begin of the insertionare treated as downloaded links, so theEnd of the insertion Begin of the deletion would cause anEnd of the deletion HTML Begin of the insertionpage is downloaded and can be opened by the user.

* Reasoning: If you have custom reports, you would like peopleEnd of the insertion Begin of the deletion documentEnd of the deletion to Begin of the insertionbe able to view the HTML. For security reasons, OpenProject does not inlineEnd of the insertion render Begin of the insertionHTML filesEnd of the insertion in Begin of the insertionthe domain of the application,End of the insertion Begin of the deletion a new tabEnd of the deletion as Begin of the insertionthis is a common attack surface for XSS, CSRF, Open Redirect vulnerabilities

<br>

End of the insertion Begin of the deletion shown.
End of the deletion <img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/231021/content">


### Important note

_Please note that unless you are a contributor to OpenProject, you can no longer edit this bug report after saving. You can still add new comments, new images and upload attachments though, but updating description or modifying fields will not be possible after saving. Please make sure that all necessary information and attachments are added, and the following attributes are set:_

### **Logs**

I have not looked at the logs.

### Screenshots and other files

I attached the relevant screen shots showing the before and after Begin of the insertionbehavior.End of the insertion Begin of the deletion behavior. End of the deletion

### Environment information

* **Current Install (when the issue was introduced):**

* Docker-compose install version 14.6.2

* **Previous Install (when the issue was absent):**

* Docker-compose install version 14.4.x


**Browser**

* [x] Chrome
* [ ] Firefox
* [ ] Safari
* [ ] Mobile Safari
* [ ] Other (please specify)

**Operating System**

* [x] Linux (Ubuntu 22.04 LTS)

**Language**

_English_