stonewareslord/treestyletab
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #349 from Infocatcher/patch-11

Browse Source 
Use checkLoadURIStrWithPrincipal() instead of checkLoadURIStr()
This commit is contained in:
YUKI "Piro" Hiroshi 2012-10-12 12:16:41 -07:00
commit c5bb7ec8ad
1 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
modules/tabbarDNDObserver.js
View File

@ -1117,20 +1117,30 @@ catch(e) {
}, },
securityCheck : function TabbarDND_securityCheck(aURI, aEvent) securityCheck : function TabbarDND_securityCheck(aURI, aEvent)
{ {
// See dragDropSecurityCheck() in chrome://global/content/nsDragAndDrop.js
let session = this.treeStyleTab.currentDragSession; let session = this.treeStyleTab.currentDragSession;
let (sourceDoc = session ? session.sourceDocument : null) { if (!session) { //TODO: use some fake nodePrincipal?
let sourceURI = sourceDoc ? sourceDoc.documentURI : 'file:///' ; aEvent.stopPropagation();
let normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI); throw 'Drop of ' + aURI + ' denied: no drag session.';
if (normalizedURI && sourceURI.indexOf('chrome://') < 0) { }
let normalizedURI;
try { try {
SecMan.checkLoadURIStr(sourceURI, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD); normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI);
}
catch(e) {
}
if (!normalizedURI)
return;
let sourceDoc = session.sourceDocument;
let principal = sourceDoc ? sourceDoc.nodePrincipal
: SecMan.getSimpleCodebasePrincipal(this.treeStyleTab.IOService.newURI("file:///", null, null));
try {
SecMan.checkLoadURIStrWithPrincipal(principal, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD);
} }
catch(e) { catch(e) {
aEvent.stopPropagation(); aEvent.stopPropagation();
throw 'Drop of ' + aURI + ' denied.'; throw 'Drop of ' + aURI + ' denied.';
} }
}
}
}, },
retrieveURLsFromDataTransfer : function TSTService_retrieveURLsFromDataTransfer(aDataTransfer) retrieveURLsFromDataTransfer : function TSTService_retrieveURLsFromDataTransfer(aDataTransfer)