Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use the principal of the node, not the URI, for the security check. Bug

Browse Source 
343065, r+sr=peterv, a=schrep


git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@201249 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzbarsky%mit.edu
2006-06-29 18:26:53 +00:00
parent 4499eb574d
commit eb4a8063aa
1 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mozilla/content/base/src/nsDOMSerializer.cpp
View File

@@ -154,15 +154,9 @@ CheckSameOrigin(nsIDOMNode *aRoot)
}
}
nsCOMPtr<nsIURI> root_uri;
nsIPrincipal *principal = doc->GetPrincipal();
if (principal) {
principal->GetURI(getter_AddRefs(root_uri));
}
if (root_uri) {
nsresult rv;
nsCOMPtr<nsIScriptSecurityManager> secMan =
do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
@@ -178,9 +172,16 @@ CheckSameOrigin(nsIDOMNode *aRoot)
return NS_OK;
}
// Check if the caller (if any) is from the same origin that the
// root is from.
return secMan->CheckSameOrigin(nsnull, root_uri);
nsCOMPtr<nsIPrincipal> subject;
rv = secMan->GetSubjectPrincipal(getter_AddRefs(subject));
NS_ENSURE_SUCCESS(rv, rv);
// Since UBR is not enabled, we better have a subject principal,
// but just in case...
if (subject) {
// Check if the caller is from the same origin that the root is from.
return secMan->CheckSameOriginPrincipal(subject, principal);
}
}
return NS_OK;