stonewareslord/treestyletab
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #349 from Infocatcher/patch-11

Browse Source 
Use checkLoadURIStrWithPrincipal() instead of checkLoadURIStr()
This commit is contained in:
YUKI "Piro" Hiroshi 2012-10-12 12:16:41 -07:00
commit c5bb7ec8ad
1 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
modules/tabbarDNDObserver.js
View File

@ -1117,20 +1117,30 @@ catch(e) {
},
securityCheck : function TabbarDND_securityCheck(aURI, aEvent)
{
// See dragDropSecurityCheck() in chrome://global/content/nsDragAndDrop.js
let session = this.treeStyleTab.currentDragSession;
let (sourceDoc = session ? session.sourceDocument : null) {
let sourceURI = sourceDoc ? sourceDoc.documentURI : 'file:///' ;
let normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI);
if (normalizedURI && sourceURI.indexOf('chrome://') < 0) {
if (!session) { //TODO: use some fake nodePrincipal?
aEvent.stopPropagation();
throw 'Drop of ' + aURI + ' denied: no drag session.';
}
let normalizedURI;
try {
SecMan.checkLoadURIStr(sourceURI, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD);
normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI);
}
catch(e) {
}
if (!normalizedURI)
return;
let sourceDoc = session.sourceDocument;
let principal = sourceDoc ? sourceDoc.nodePrincipal
: SecMan.getSimpleCodebasePrincipal(this.treeStyleTab.IOService.newURI("file:///", null, null));
try {
SecMan.checkLoadURIStrWithPrincipal(principal, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD);
}
catch(e) {
aEvent.stopPropagation();
throw 'Drop of ' + aURI + ' denied.';
}
}
}
},
retrieveURLsFromDataTransfer : function TSTService_retrieveURLsFromDataTransfer(aDataTransfer)