History

possible fix for openUrl exploit

SamGondelman committed 7 years ago

Commit 31b3f0e1 parent 50583d311 files · +50 −32Browse files

Showing the changes to interface/src/scripting/WindowScriptingInterface.cpp (1 of 11 files). Show all

Unified · Split

interface/src/scripting/WindowScriptingInterface.cpp+5−2
@@ -27,6 +27,7 @@ · 26 unmodified lines
27#include "MainWindow.h"27#include "MainWindow.h"
28#include "Menu.h"28#include "Menu.h"
29#include "OffscreenUi.h"29#include "OffscreenUi.h"
30#include "commerce/QmlCommerce.h"
30 31
31static const QString DESKTOP_LOCATION = QStandardPaths::writableLocation(QStandardPaths::DesktopLocation);32static const QString DESKTOP_LOCATION = QStandardPaths::writableLocation(QStandardPaths::DesktopLocation);
32static const QString LAST_BROWSE_LOCATION_SETTING = "LastBrowseLocation";33static const QString LAST_BROWSE_LOCATION_SETTING = "LastBrowseLocation";
@@ -134,15 +135,17 @@ void WindowScriptingInterface::disconnectedFromDomain() { · 101 unmodified lines
134 135
135void WindowScriptingInterface::openUrl(const QUrl& url) {136void WindowScriptingInterface::openUrl(const QUrl& url) {
136 if (!url.isEmpty()) {137 if (!url.isEmpty()) {
137 if (url.scheme() == URL_SCHEME_HIFI) {138 auto scheme = url.scheme();
139 if (scheme == URL_SCHEME_HIFI) {
138 DependencyManager::get<AddressManager>()->handleLookupString(url.toString());140 DependencyManager::get<AddressManager>()->handleLookupString(url.toString());
141 } else if (scheme == URL_SCHEME_HIFIAPP) {
142 DependencyManager::get<QmlCommerce>()->openSystemApp(url.path());
139 } else {143 } else {
140#if defined(Q_OS_ANDROID)144#if defined(Q_OS_ANDROID)
141 QMap<QString, QString> args;145 QMap<QString, QString> args;
142 args["url"] = url.toString();146 args["url"] = url.toString();
143 AndroidHelper::instance().requestActivity("WebView", true, args);147 AndroidHelper::instance().requestActivity("WebView", true, args);
144#else148#else
145 // address manager did not handle - ask QDesktopServices to handle
146 QDesktopServices::openUrl(url);149 QDesktopServices::openUrl(url);
147#endif150#endif
148 }151 }