Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit xbl:implements a tad. Bug 299518, r=jst, sr=shaver

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@179051 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzbarsky%mit.edu 2005-08-26 14:47:35 +00:00
parent fe858d483a
commit 41e3f72519
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
mozilla/content/xbl/src/nsXBLContentSink.cpp
View File

@ -61,6 +61,7 @@
#include "nsIScriptError.h"
#include "nsNodeInfoManager.h"
#include "nsINodeInfo.h"
#include "nsIPrincipal.h"
nsresult
NS_NewXBLContentSink(nsIXMLContentSink** aResult,
@ -714,7 +715,25 @@ nsXBLContentSink::ConstructImplementation(const PRUnichar **aAtts)
name = aAtts[1];
}
else if (localName == nsXBLAtoms::implements) {
mBinding->ConstructInterfaceTable(nsDependentString(aAtts[1]));
// Only allow implementation of interfaces via XBL if the principal of
// our XBL document has UniversalXPConnect privileges. No principal
// means no privs!
nsIPrincipal* principal = mDocument->GetPrincipal();
if (principal) {
// XXX this api is so badly tied to JS it's not even funny. We don't
// have a concept of enabling capabilities on a per-principal basis,
// but only on a per-principal-and-JS-stackframe basis! So for now
// this is basically equivalent to testing that we have the system
// principal, since there is no JS stackframe in sight here...
PRBool hasUniversalXPConnect;
nsresult rv = principal->IsCapabilityEnabled("UniversalXPConnect",
nsnull,
&hasUniversalXPConnect);
if (NS_SUCCEEDED(rv) && hasUniversalXPConnect) {
mBinding->ConstructInterfaceTable(nsDependentString(aAtts[1]));
}
}
}
}