History

possible fix for openUrl exploit

SamGondelman committed 7 years ago

Commit 31b3f0e1 parent 50583d311 files · +50 −32Browse files

Showing the changes to interface/src/scripting/WindowScriptingInterface.cpp (1 of 11 files). Show all

Unified · Split

interface/src/scripting/WindowScriptingInterface.cpp+5−2
@@ -27,6 +27,7 @@ · 26 unmodified lines
2727 #include "MainWindow.h"
2828 #include "Menu.h"
2929 #include "OffscreenUi.h"
30+#include "commerce/QmlCommerce.h"
3031
3132 static const QString DESKTOP_LOCATION = QStandardPaths::writableLocation(QStandardPaths::DesktopLocation);
3233 static const QString LAST_BROWSE_LOCATION_SETTING = "LastBrowseLocation";
@@ -134,15 +135,17 @@ void WindowScriptingInterface::disconnectedFromDomain() { · 101 unmodified lines
134135
135136 void WindowScriptingInterface::openUrl(const QUrl& url) {
136137 if (!url.isEmpty()) {
137− if (url.scheme() == URL_SCHEME_HIFI) {
138+ auto scheme = url.scheme();
139+ if (scheme == URL_SCHEME_HIFI) {
138140 DependencyManager::get<AddressManager>()->handleLookupString(url.toString());
141+ } else if (scheme == URL_SCHEME_HIFIAPP) {
142+ DependencyManager::get<QmlCommerce>()->openSystemApp(url.path());
139143 } else {
140144 #if defined(Q_OS_ANDROID)
141145 QMap<QString, QString> args;
142146 args["url"] = url.toString();
143147 AndroidHelper::instance().requestActivity("WebView", true, args);
144148 #else
145− // address manager did not handle - ask QDesktopServices to handle
146149 QDesktopServices::openUrl(url);
147150 #endif
148151 }