Index: openacs-4/packages/xowiki/tcl/link-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/link-procs.tcl,v
diff -u -N -r1.106.2.12 -r1.106.2.13
--- openacs-4/packages/xowiki/tcl/link-procs.tcl	18 Mar 2020 16:13:21 -0000	1.106.2.12
+++ openacs-4/packages/xowiki/tcl/link-procs.tcl	20 Mar 2020 07:24:41 -0000	1.106.2.13
@@ -481,17 +481,41 @@
   }
 
   #
+  #
   # file link
   #
 
   Class create ::xowiki::Link::file -superclass ::xowiki::Link::image -parameter {
-    width height align pluginspage pluginurl hidden href
-    autostart loop volume controls controller mastersound starttime endtime
+    width height hidden
   }
+  foreach deprecated_attribute {
+    align name pluginspage pluginurl href autostart
+    loop volume controls controller mastersound starttime endtime
+  } {
 
+    ::xowiki::Link::file ad_instproc -deprecated $deprecated_attribute {value:optional} {
+      Provide warning for deprecated HTML attribute;
+      this will be removed in releases after OpenACS 5.10.
+    } {
+      if {[info exists value]} {
+        set :[self proc] $value
+      }
+      return [set :[self proc]]
+    }
+
+  }
+
   ::xowiki::Link::file instproc render_found {internal_href label} {
+    #
+    # Many of the attributes below are from HTML4 and deprecated (see
+    # "deprecated_attribute" above). We just removed "href" from the list
+    # of still accepted attributes, since this is set often via BaseLink,
+    # and it could harm applications, where the "<EMBED href> variant of the
+    # stopped working due to newer browsers, stopping to support legacy
+    # HTML attributes.
+    #
     foreach f {
-      width height align pluginspage pluginurl hidden
+      width height align pluginspage pluginurl hidden href
       autostart loop volume controls controller mastersound starttime endtime
     } {
       if {[info exists :$f]} {