Showing the changes to interface/src/scripting/DesktopScriptingInterface.cpp (1 of 1 file). Show all
Unified · Split
| @@ -117,5 +117,15 @@ InteractiveWindowPointer DesktopScriptingInterface::createWindow(const QString& · 116 unmodified lines | |||
| 117 | Q_ARG(QVariantMap, properties)); | 117 | Q_ARG(QVariantMap, properties)); |
| 118 | return interactiveWindow; | 118 | return interactiveWindow; |
| 119 | } | 119 | } |
| 120 | return new InteractiveWindow(sourceUrl, properties);; | 120 | |
| 121 | |||
| 122 | // The offscreen surface already validates against non-local QML sources, but we also need to ensure that | ||
| 123 | // if we create top level QML, like dock widgets or other types of QQuickView containing desktop windows | ||
| 124 | // that the source URL is permitted | ||
| 125 | const auto& urlValidator = OffscreenQmlSurface::getUrlValidator(); | ||
| 126 | if (!urlValidator(sourceUrl)) { | ||
| 127 | return nullptr; | ||
| 128 | } | ||
| 129 | |||
| 130 | return new InteractiveWindow(sourceUrl, properties); | ||
| 121 | } | 131 | } |