diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp index ac0bafef204..8f62fcad322 100644 --- a/mozilla/docshell/base/nsDocShell.cpp +++ b/mozilla/docshell/base/nsDocShell.cpp @@ -7594,7 +7594,7 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, #endif nsresult rv = NS_OK; - nsCOMPtr entry; + nsCOMPtr entry; PRBool shouldPersist; shouldPersist = ShouldAddToSessionHistory(aURI); @@ -7610,7 +7610,7 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, if (LOAD_TYPE_HAS_FLAGS(mLoadType, LOAD_FLAGS_REPLACE_HISTORY) && root != NS_STATIC_CAST(nsIDocShellTreeItem *, this)) { // This is a subframe - entry = mOSHE; + entry = do_QueryInterface(mOSHE); nsCOMPtr shContainer(do_QueryInterface(entry)); if (shContainer) { PRInt32 childCount = 0; @@ -7638,6 +7638,7 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, nsCOMPtr referrerURI; nsCOMPtr cacheKey; nsCOMPtr cacheToken; + nsCOMPtr owner; PRBool expired = PR_FALSE; PRBool discardLayoutState = PR_FALSE; if (aChannel) { @@ -7665,15 +7666,17 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, discardLayoutState = ShouldDiscardLayoutState(httpChannel); } + aChannel->GetOwner(getter_AddRefs(owner)); } //Title is set in nsDocShell::SetTitle() - entry->Create(aURI, // uri - EmptyString(), // Title - inputStream, // Post data stream - nsnull, // LayoutHistory state - cacheKey, // CacheKey - mContentTypeHint); // Content-type + entry->Create_MOZILLA_1_8_BRANCH(aURI, // uri + EmptyString(), // Title + inputStream, // Post data stream + nsnull, // LayoutHistory state + cacheKey, // CacheKey + mContentTypeHint, // Content-type + owner); // Channel owner entry->SetReferrerURI(referrerURI); /* If cache got a 'no-store', ask SH not to store * HistoryLayoutState. By default, SH will set this @@ -7751,6 +7754,7 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, PRUint32 aLoadType) nsCOMPtr postData; nsCOMPtr referrerURI; nsCAutoString contentType; + nsCOMPtr owner; NS_ENSURE_TRUE(aEntry, NS_ERROR_FAILURE); @@ -7761,6 +7765,13 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, PRUint32 aLoadType) NS_ERROR_FAILURE); NS_ENSURE_SUCCESS(aEntry->GetContentType(contentType), NS_ERROR_FAILURE); + nsCOMPtr branchEntry = + do_QueryInterface(aEntry); + NS_ENSURE_TRUE(branchEntry, NS_ERROR_UNEXPECTED); + NS_ENSURE_SUCCESS(branchEntry->GetOwner(getter_AddRefs(owner)), + NS_ERROR_FAILURE); + + PRBool isJavaScript, isViewSource, isData; // Calling CreateAboutBlankContentViewer can set mOSHE to null, and if // that's the only thing holding a ref to aEntry that will cause aEntry to @@ -7784,6 +7795,20 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, PRUint32 aLoadType) // user prevented it). Interrupt the history load. return NS_OK; } + + if (!owner) { + // Ensure that we have an owner, just to make sure that nothing + // reuses the principal of the about:blank page that just got + // created. + nsCOMPtr secMan = + do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv); + NS_ENSURE_SUCCESS(rv, rv); + + nsCOMPtr prin; + secMan->GetCodebasePrincipal(uri, getter_AddRefs(prin)); + owner = prin; + NS_ENSURE_TRUE(owner, NS_ERROR_OUT_OF_MEMORY); + } } /* If there is a valid postdata *and* the user pressed @@ -7816,7 +7841,7 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, PRUint32 aLoadType) rv = InternalLoad(uri, referrerURI, - nsnull, // No owner + owner, INTERNAL_LOAD_FLAGS_NONE, // Do not inherit owner from document (security-critical!) nsnull, // No window target contentType.get(), // Type hint diff --git a/mozilla/xpfe/components/shistory/public/nsISHEntry.idl b/mozilla/xpfe/components/shistory/public/nsISHEntry.idl index 9a69d7d4ef5..dddd2bbb0c2 100644 --- a/mozilla/xpfe/components/shistory/public/nsISHEntry.idl +++ b/mozilla/xpfe/components/shistory/public/nsISHEntry.idl @@ -182,6 +182,23 @@ interface nsISHEntry : nsIHistoryEntry nsIContentViewer getAnyContentViewer(out nsISHEntry ownerEntry); }; +[scriptable, uuid(ab044652-b327-4108-b7ba-f72c4b4fec9d)] +interface nsISHEntry_MOZILLA_1_8_BRANCH : nsISHEntry +{ + void create_MOZILLA_1_8_BRANCH(in nsIURI URI, in AString title, + in nsIInputStream inputStream, + in nsILayoutHistoryState layoutHistoryState, + in nsISupports cacheKey, + in ACString contentType, + in nsISupports owner); + + /** + * Get the owner, if any, that was associated with the channel + * that the document that was loaded to create this history entry + * came from. + */ + readonly attribute nsISupports owner; +}; %{ C++ // {BFD1A791-AD9F-11d3-BDC7-0050040A9B44} diff --git a/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp b/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp index 2fc4146b027..f78e10dcda1 100644 --- a/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp +++ b/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp @@ -96,6 +96,7 @@ nsSHEntry::nsSHEntry(const nsSHEntry &other) , mCacheKey(other.mCacheKey) , mParent(other.mParent) , mViewerBounds(0, 0, 0, 0) + , mOwner(other.mOwner) { } @@ -123,7 +124,8 @@ nsSHEntry::~nsSHEntry() // nsSHEntry: nsISupports //***************************************************************************** -NS_IMPL_ISUPPORTS4(nsSHEntry, nsISHContainer, nsISHEntry, nsIHistoryEntry, +NS_IMPL_ISUPPORTS5(nsSHEntry, nsISHContainer, nsISHEntry, + nsISHEntry_MOZILLA_1_8_BRANCH, nsIHistoryEntry, nsIDocumentObserver) //***************************************************************************** @@ -400,12 +402,26 @@ nsSHEntry::Create(nsIURI * aURI, const nsAString &aTitle, nsIInputStream * aInputStream, nsILayoutHistoryState * aLayoutHistoryState, nsISupports * aCacheKey, const nsACString& aContentType) +{ + return Create_MOZILLA_1_8_BRANCH(aURI, aTitle, aInputStream, + aLayoutHistoryState, aCacheKey, + aContentType, nsnull); +} + +NS_IMETHODIMP +nsSHEntry::Create_MOZILLA_1_8_BRANCH(nsIURI * aURI, const nsAString &aTitle, + nsIInputStream * aInputStream, + nsILayoutHistoryState * aLayoutHistoryState, + nsISupports * aCacheKey, + const nsACString& aContentType, + nsISupports* aOwner) { mURI = aURI; mTitle = aTitle; mPostData = aInputStream; mCacheKey = aCacheKey; mContentType = aContentType; + mOwner = aOwner; // Set the LoadType by default to loadHistory during creation mLoadType = (PRUint32) nsIDocShellLoadInfo::loadHistory; @@ -484,6 +500,13 @@ nsSHEntry::GetViewerBounds(nsRect &aBounds) return NS_OK; } +NS_IMETHODIMP +nsSHEntry::GetOwner(nsISupports **aOwner) +{ + NS_IF_ADDREF(*aOwner = mOwner); + return NS_OK; +} + //***************************************************************************** // nsSHEntry: nsISHContainer //***************************************************************************** diff --git a/mozilla/xpfe/components/shistory/src/nsSHEntry.h b/mozilla/xpfe/components/shistory/src/nsSHEntry.h index b90db2fc161..8578c634ee1 100644 --- a/mozilla/xpfe/components/shistory/src/nsSHEntry.h +++ b/mozilla/xpfe/components/shistory/src/nsSHEntry.h @@ -59,7 +59,7 @@ #include "nsSupportsArray.h" #include "nsIDocumentObserver.h" -class nsSHEntry : public nsISHEntry, +class nsSHEntry : public nsISHEntry_MOZILLA_1_8_BRANCH, public nsISHContainer, public nsIDocumentObserver { @@ -70,6 +70,7 @@ public: NS_DECL_ISUPPORTS NS_DECL_NSIHISTORYENTRY NS_DECL_NSISHENTRY + NS_DECL_NSISHENTRY_MOZILLA_1_8_BRANCH NS_DECL_NSISHCONTAINER NS_DECL_NSIDOCUMENTOBSERVER @@ -104,6 +105,7 @@ private: nsRect mViewerBounds; nsCOMArray mChildShells; nsCOMPtr mRefreshURIList; + nsCOMPtr mOwner; }; #endif /* nsSHEntry_h */