Showing the changes to libraries/script-engine/src/ScriptPermissions.cpp (1 of 6 files). Show all
Unified · Split
| @@ -60,24 +60,32 @@ bool ScriptPermissions::isCurrentScriptAllowed(ScriptPermissions::Permission per · 59 unmodified lines | ||
| 60 | 60 | } |
| 61 | 61 | std::vector<QString> urlsToCheck; |
| 62 | 62 | QString scriptURL = manager->getAbsoluteFilename(); |
| 63 | − if (scriptURL.startsWith("about:Entities")) { | |
| 64 | − // This is entity script manager, we need to find the file name of the current script instead | |
| 65 | − scriptURL = Scriptable::context()->currentFileName(); | |
| 63 | + | |
| 64 | + // If this is an entity script manager, we need to find the file name of the current script instead | |
| 65 | + if (!scriptURL.startsWith("about:Entities")) { | |
| 66 | 66 | urlsToCheck.push_back(scriptURL); |
| 67 | − if (PERMISSIONS_DEBUG_ENABLED) { | |
| 68 | − qDebug() << "ScriptPermissions::isCurrentScriptAllowed: filename: " << scriptURL; | |
| 69 | − } | |
| 70 | − auto parentContext = Scriptable::context()->parentContext(); | |
| 71 | − while (parentContext) { | |
| 67 | + } | |
| 68 | + | |
| 69 | + auto currentURL = Scriptable::context()->currentFileName(); | |
| 70 | + if (!currentURL.isEmpty() && currentURL != scriptURL) { | |
| 71 | + urlsToCheck.push_back(currentURL); | |
| 72 | + } | |
| 73 | + | |
| 74 | + if (PERMISSIONS_DEBUG_ENABLED) { | |
| 75 | + qDebug() << "ScriptPermissions::isCurrentScriptAllowed: filename: " << scriptURL; | |
| 76 | + } | |
| 77 | + auto parentContext = Scriptable::context()->parentContext(); | |
| 78 | + while (parentContext) { | |
| 79 | + QString parentFilename = parentContext->currentFileName(); | |
| 80 | + if (!parentFilename.isEmpty()) { | |
| 72 | 81 | urlsToCheck.push_back(parentContext->currentFileName()); |
| 73 | 82 | if (PERMISSIONS_DEBUG_ENABLED) { |
| 74 | 83 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: parent filename: " << parentContext->currentFileName(); |
| 75 | 84 | } |
| 76 | − parentContext = parentContext->parentContext(); | |
| 77 | 85 | } |
| 78 | − } else { | |
| 79 | − urlsToCheck.push_back(scriptURL); | |
| 86 | + parentContext = parentContext->parentContext(); | |
| 80 | 87 | } |
| 88 | + | |
| 81 | 89 | // Check if the script is allowed: |
| 82 | 90 | QList<QString> safeURLPrefixes = { "file:///", "qrc:/", NetworkingConstants::OVERTE_COMMUNITY_APPLICATIONS, |
| 83 | 91 | NetworkingConstants::OVERTE_TUTORIAL_SCRIPTS, "about:console"}; |
| @@ -88,19 +96,26 @@ bool ScriptPermissions::isCurrentScriptAllowed(ScriptPermissions::Permission per · 4 unmodified lines | ||
| 88 | 96 | safeURLPrefixes.push_back(entry); |
| 89 | 97 | } |
| 90 | 98 | |
| 91 | − for (const auto& str : safeURLPrefixes) { | |
| 92 | − if (!str.isEmpty() && scriptURL.startsWith(str)) { | |
| 99 | + for (auto urlToCheck : urlsToCheck) { | |
| 100 | + bool urlIsAllowed = false; | |
| 101 | + for (const auto& str : safeURLPrefixes) { | |
| 102 | + if (!str.isEmpty() && urlToCheck.startsWith(str)) { | |
| 103 | + urlIsAllowed = true; | |
| 104 | + if (PERMISSIONS_DEBUG_ENABLED) { | |
| 105 | + qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] | |
| 106 | + << " for script " << urlToCheck << " accepted with rule: " << str; | |
| 107 | + } | |
| 108 | + } | |
| 109 | + } | |
| 110 | + | |
| 111 | + if (!urlIsAllowed) { | |
| 93 | 112 | if (PERMISSIONS_DEBUG_ENABLED) { |
| 94 | 113 | qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] |
| 95 | − << " for script " << scriptURL << " accepted with rule: " << str; | |
| 114 | + << " for script " << urlToCheck << " rejected."; | |
| 96 | 115 | } |
| 97 | − return true; | |
| 116 | + return false; | |
| 98 | 117 | } |
| 99 | 118 | } |
| 100 | 119 | |
| 101 | − if (PERMISSIONS_DEBUG_ENABLED) { | |
| 102 | − qDebug() << "ScriptPermissions::isCurrentScriptAllowed: " << scriptPermissionNames[permissionIndex] << " for script " | |
| 103 | − << scriptURL << " rejected."; | |
| 104 | − } | |
| 105 | − return false; | |
| 120 | + return true; | |
| 106 | 121 | } |