History

Merge pull request #13737 from jherico/fix/fb16633_a

Don't allow Web surfaces created by non-client scripts to access files

Sam Gateau committed 8 years ago

Commit c1951da2 parents 243bd5e 8e9c1e526 files · +276 −234Browse files

Showing the changes to interface/src/Application.cpp (1 of 26 files). Show all

Unified · Split

interface/src/Application.cpp+4−3
@@ -6619,11 +6619,12 @@ void Application::registerScriptEngineWithApplicationServices(ScriptEnginePointe · 6618 unmodified lines
66196619 scriptEngine->registerGetterSetter("location", LocationScriptingInterface::locationGetter,
66206620 LocationScriptingInterface::locationSetter);
66216621
6622+ bool clientScript = scriptEngine->isClientScript();
6623+ scriptEngine->registerFunction("OverlayWindow", clientScript ? QmlWindowClass::constructor : QmlWindowClass::restricted_constructor);
66226624 #if !defined(Q_OS_ANDROID)
6623− scriptEngine->registerFunction("OverlayWebWindow", QmlWebWindowClass::constructor);
6625+ scriptEngine->registerFunction("OverlayWebWindow", clientScript ? QmlWebWindowClass::constructor : QmlWebWindowClass::restricted_constructor);
66246626 #endif
6625− scriptEngine->registerFunction("OverlayWindow", QmlWindowClass::constructor);
6626− scriptEngine->registerFunction("QmlFragment", QmlFragmentClass::constructor);
6627+ scriptEngine->registerFunction("QmlFragment", clientScript ? QmlFragmentClass::constructor : QmlFragmentClass::restricted_constructor);
66276628
66286629 scriptEngine->registerGlobalObject("Menu", MenuScriptingInterface::getInstance());
66296630 scriptEngine->registerGlobalObject("DesktopPreviewProvider", DependencyManager::get<DesktopPreviewProvider>().data());