diff --git a/mozilla/dom/src/base/nsGlobalWindow.cpp b/mozilla/dom/src/base/nsGlobalWindow.cpp index 26d726ae360..2579aaca3e4 100644 --- a/mozilla/dom/src/base/nsGlobalWindow.cpp +++ b/mozilla/dom/src/base/nsGlobalWindow.cpp @@ -2939,7 +2939,7 @@ nsGlobalWindow::GetOpener(nsIDOMWindowInternal** aOpener) *aOpener = nsnull; - nsCOMPtr opener = do_QueryReferent(mOpener); + nsCOMPtr opener = do_QueryReferent(mOpener); if (!opener) { return NS_OK; } @@ -2950,27 +2950,36 @@ nsGlobalWindow::GetOpener(nsIDOMWindowInternal** aOpener) return NS_OK; } + nsCOMPtr openerPwin(do_QueryInterface(opener)); + if (!openerPwin) { + return NS_OK; + } + + // First, ensure that we're not handing back a chrome window. + nsGlobalWindow *win = static_cast(openerPwin.get()); + if (win->IsChromeWindow()) { + return NS_OK; + } + // We don't want to reveal the opener if the opener is a mail window, // because opener can be used to spoof the contents of a message (bug 105050). // So, we look in the opener's root docshell to see if it's a mail window. - nsCOMPtr openerPwin(do_QueryInterface(opener)); - if (openerPwin) { - nsCOMPtr docShellAsItem = - do_QueryInterface(openerPwin->GetDocShell()); + nsCOMPtr docShellAsItem = + do_QueryInterface(openerPwin->GetDocShell()); - if (docShellAsItem) { - nsCOMPtr openerRootItem; - docShellAsItem->GetRootTreeItem(getter_AddRefs(openerRootItem)); - nsCOMPtr openerRootDocShell(do_QueryInterface(openerRootItem)); - if (openerRootDocShell) { - PRUint32 appType; - nsresult rv = openerRootDocShell->GetAppType(&appType); - if (NS_SUCCEEDED(rv) && appType != nsIDocShell::APP_TYPE_MAIL) { - *aOpener = opener; - } + if (docShellAsItem) { + nsCOMPtr openerRootItem; + docShellAsItem->GetRootTreeItem(getter_AddRefs(openerRootItem)); + nsCOMPtr openerRootDocShell(do_QueryInterface(openerRootItem)); + if (openerRootDocShell) { + PRUint32 appType; + nsresult rv = openerRootDocShell->GetAppType(&appType); + if (NS_SUCCEEDED(rv) && appType != nsIDocShell::APP_TYPE_MAIL) { + *aOpener = opener; } } } + NS_IF_ADDREF(*aOpener); return NS_OK; }