Showing the changes to libraries/script-engine/src/ScriptPermissions.cpp (1 of 6 files). Show all
Unified · Split
| @@ -60,24 +60,32 @@ bool ScriptPermissions::isCurrentScriptAllowed(ScriptPermissions::Permission per · 59 unmodified lines | |||
| 60 | } | 60 | } |
| 61 | std::vector<QString> urlsToCheck; | 61 | std::vector<QString> urlsToCheck; |
| 62 | QString scriptURL = manager->getAbsoluteFilename(); | 62 | QString scriptURL = manager->getAbsoluteFilename(); |
| 63 | if (scriptURL.startsWith("about:Entities")) { | 63 | |
| 64 | // This is entity script manager, we need to find the file name of the current script instead | 64 | // If this is an entity script manager, we need to find the file name of the current script instead |
| 65 | scriptURL = Scriptable::context()->currentFileName(); | 65 | if (!scriptURL.startsWith("about:Entities")) { |
| 66 | urlsToCheck.push_back(scriptURL); | 66 | urlsToCheck.push_back(scriptURL); |
| 67 | if (PERMISSIONS_DEBUG_ENABLED) { | 67 | } |
| 68 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: filename: " << scriptURL; | 68 | |
| 69 | } | 69 | auto currentURL = Scriptable::context()->currentFileName(); |
| 70 | auto parentContext = Scriptable::context()->parentContext(); | 70 | if (!currentURL.isEmpty() && currentURL != scriptURL) { |
| 71 | while (parentContext) { | 71 | urlsToCheck.push_back(currentURL); |
| 72 | } | ||
| 73 | |||
| 74 | if (PERMISSIONS_DEBUG_ENABLED) { | ||
| 75 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: filename: " << scriptURL; | ||
| 76 | } | ||
| 77 | auto parentContext = Scriptable::context()->parentContext(); | ||
| 78 | while (parentContext) { | ||
| 79 | QString parentFilename = parentContext->currentFileName(); | ||
| 80 | if (!parentFilename.isEmpty()) { | ||
| 72 | urlsToCheck.push_back(parentContext->currentFileName()); | 81 | urlsToCheck.push_back(parentContext->currentFileName()); |
| 73 | if (PERMISSIONS_DEBUG_ENABLED) { | 82 | if (PERMISSIONS_DEBUG_ENABLED) { |
| 74 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: parent filename: " << parentContext->currentFileName(); | 83 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: parent filename: " << parentContext->currentFileName(); |
| 75 | } | 84 | } |
| 76 | parentContext = parentContext->parentContext(); | ||
| 77 | } | 85 | } |
| 78 | } else { | 86 | parentContext = parentContext->parentContext(); |
| 79 | urlsToCheck.push_back(scriptURL); | ||
| 80 | } | 87 | } |
| 88 | |||
| 81 | // Check if the script is allowed: | 89 | // Check if the script is allowed: |
| 82 | QList<QString> safeURLPrefixes = { "file:///", "qrc:/", NetworkingConstants::OVERTE_COMMUNITY_APPLICATIONS, | 90 | QList<QString> safeURLPrefixes = { "file:///", "qrc:/", NetworkingConstants::OVERTE_COMMUNITY_APPLICATIONS, |
| 83 | NetworkingConstants::OVERTE_TUTORIAL_SCRIPTS, "about:console"}; | 91 | NetworkingConstants::OVERTE_TUTORIAL_SCRIPTS, "about:console"}; |
| @@ -88,19 +96,26 @@ bool ScriptPermissions::isCurrentScriptAllowed(ScriptPermissions::Permission per · 4 unmodified lines | |||
| 88 | safeURLPrefixes.push_back(entry); | 96 | safeURLPrefixes.push_back(entry); |
| 89 | } | 97 | } |
| 90 | 98 | ||
| 91 | for (const auto& str : safeURLPrefixes) { | 99 | for (auto urlToCheck : urlsToCheck) { |
| 92 | if (!str.isEmpty() && scriptURL.startsWith(str)) { | 100 | bool urlIsAllowed = false; |
| 101 | for (const auto& str : safeURLPrefixes) { | ||
| 102 | if (!str.isEmpty() && urlToCheck.startsWith(str)) { | ||
| 103 | urlIsAllowed = true; | ||
| 104 | if (PERMISSIONS_DEBUG_ENABLED) { | ||
| 105 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] | ||
| 106 | << " for script " << urlToCheck << " accepted with rule: " << str; | ||
| 107 | } | ||
| 108 | } | ||
| 109 | } | ||
| 110 | |||
| 111 | if (!urlIsAllowed) { | ||
| 93 | if (PERMISSIONS_DEBUG_ENABLED) { | 112 | if (PERMISSIONS_DEBUG_ENABLED) { |
| 94 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] | 113 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] |
| 95 | << " for script " << scriptURL << " accepted with rule: " << str; | 114 | << " for script " << urlToCheck << " rejected."; |
| 96 | } | 115 | } |
| 97 | return true; | 116 | return false; |
| 98 | } | 117 | } |
| 99 | } | 118 | } |
| 100 | 119 | ||
| 101 | if (PERMISSIONS_DEBUG_ENABLED) { | 120 | return true; |
| 102 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] << " for script " | ||
| 103 | << scriptURL << " rejected."; | ||
| 104 | } | ||
| 105 | return false; | ||
| 106 | } | 121 | } |