|
 |
b1bd9f |
From 2c71565673c4750732c7e507d2aaf9c3b1f679df Mon Sep 17 00:00:00 2001
|
|
|
b1bd9f |
From: Stephan Bergmann <sbergman@redhat.com>
|
|
|
b1bd9f |
Date: Tue, 6 Aug 2019 13:29:22 +0200
|
|
|
b1bd9f |
Subject: [PATCH] Properly obtain location
|
|
|
b1bd9f |
MIME-Version: 1.0
|
|
|
b1bd9f |
Content-Type: text/plain; charset=UTF-8
|
|
|
b1bd9f |
Content-Transfer-Encoding: 8bit
|
|
|
b1bd9f |
|
|
|
b1bd9f |
Change-Id: I9fb0d883a3623394343cd54ef61e5610544198c8
|
|
|
b1bd9f |
Reviewed-on: https://gerrit.libreoffice.org/77019
|
|
|
b1bd9f |
Tested-by: Jenkins
|
|
|
b1bd9f |
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
|
|
|
b1bd9f |
(cherry picked from commit a9cde2557242a0c343d99533f3ee032599c66f42)
|
|
|
b1bd9f |
Reviewed-on: https://gerrit.libreoffice.org/77024
|
|
|
b1bd9f |
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
|
|
|
b1bd9f |
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
|
|
|
b1bd9f |
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
|
|
|
b1bd9f |
Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
|
|
|
b1bd9f |
---
|
|
|
b1bd9f |
.../source/protocolhandler/scripthandler.cxx | 9 ++++++--
|
|
|
b1bd9f |
sfx2/source/doc/objmisc.cxx | 21 +++++++++++--------
|
|
|
b1bd9f |
2 files changed, 19 insertions(+), 11 deletions(-)
|
|
|
b1bd9f |
|
|
|
b1bd9f |
diff --git a/scripting/source/protocolhandler/scripthandler.cxx b/scripting/source/protocolhandler/scripthandler.cxx
|
|
|
b1bd9f |
index cd82b19..1bc577b 100644
|
|
|
b1bd9f |
--- a/scripting/source/protocolhandler/scripthandler.cxx
|
|
|
b1bd9f |
+++ b/scripting/source/protocolhandler/scripthandler.cxx
|
|
|
b1bd9f |
@@ -51,6 +51,7 @@
|
|
|
b1bd9f |
#include "com/sun/star/uri/XUriReference.hpp"
|
|
|
b1bd9f |
#include "com/sun/star/uri/UriReferenceFactory.hpp"
|
|
|
b1bd9f |
#include "com/sun/star/uri/XVndSunStarScriptUrl.hpp"
|
|
|
b1bd9f |
+#include <com/sun/star/uri/XVndSunStarScriptUrlReference.hpp>
|
|
|
b1bd9f |
|
|
|
b1bd9f |
#include <memory>
|
|
|
b1bd9f |
|
|
|
b1bd9f |
@@ -146,8 +147,12 @@ void SAL_CALL ScriptProtocolHandler::dispatchWithNotification(
|
|
|
b1bd9f |
{
|
|
|
b1bd9f |
try
|
|
|
b1bd9f |
{
|
|
|
b1bd9f |
- bool bIsDocumentScript = ( aURL.Complete.indexOf( "document" ) !=-1 );
|
|
|
b1bd9f |
- // TODO: isn't this somewhat strange? This should be a test for a location=document parameter, shouldn't it?
|
|
|
b1bd9f |
+ css::uno::Reference<css::uri::XUriReferenceFactory> urifac(
|
|
|
b1bd9f |
+ css::uri::UriReferenceFactory::create(m_xContext));
|
|
|
b1bd9f |
+ css::uno::Reference<css::uri::XVndSunStarScriptUrlReference> uri(
|
|
|
b1bd9f |
+ urifac->parse(aURL.Complete), css::uno::UNO_QUERY_THROW);
|
|
|
b1bd9f |
+ auto const loc = uri->getParameter("location");
|
|
|
b1bd9f |
+ bool bIsDocumentScript = loc == "document";
|
|
|
b1bd9f |
|
|
|
b1bd9f |
if ( bIsDocumentScript )
|
|
|
b1bd9f |
{
|
|
|
b1bd9f |
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
|
|
|
b1bd9f |
index 24d131a..87580cb 100644
|
|
|
b1bd9f |
--- a/sfx2/source/doc/objmisc.cxx
|
|
|
b1bd9f |
+++ b/sfx2/source/doc/objmisc.cxx
|
|
|
b1bd9f |
@@ -1462,19 +1462,22 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon
|
|
|
b1bd9f |
OSL_TRACE( "in CallXScript" );
|
|
|
b1bd9f |
ErrCode nErr = ERRCODE_NONE;
|
|
|
b1bd9f |
|
|
|
b1bd9f |
- bool bIsDocumentScript = ( _rScriptURL.indexOf( "location=document" ) >= 0 );
|
|
|
b1bd9f |
- // TODO: we should parse the URL, and check whether there is a parameter with this name.
|
|
|
b1bd9f |
- // Otherwise, we might find too much.
|
|
|
b1bd9f |
- if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
|
|
|
b1bd9f |
- return ERRCODE_IO_ACCESSDENIED;
|
|
|
b1bd9f |
-
|
|
|
b1bd9f |
- if ( UnTrustedScript(_rScriptURL) )
|
|
|
b1bd9f |
- return ERRCODE_IO_ACCESSDENIED;
|
|
|
b1bd9f |
-
|
|
|
b1bd9f |
bool bCaughtException = false;
|
|
|
b1bd9f |
Any aException;
|
|
|
b1bd9f |
try
|
|
|
b1bd9f |
{
|
|
|
b1bd9f |
+ css::uno::Reference<css::uri::XUriReferenceFactory> urifac(
|
|
|
b1bd9f |
+ css::uri::UriReferenceFactory::create(comphelper::getProcessComponentContext()));
|
|
|
b1bd9f |
+ css::uno::Reference<css::uri::XVndSunStarScriptUrlReference> uri(
|
|
|
b1bd9f |
+ urifac->parse(_rScriptURL), css::uno::UNO_QUERY_THROW);
|
|
|
b1bd9f |
+ auto const loc = uri->getParameter("location");
|
|
|
b1bd9f |
+ bool bIsDocumentScript = loc == "document";
|
|
|
b1bd9f |
+ if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
|
|
|
b1bd9f |
+ return ERRCODE_IO_ACCESSDENIED;
|
|
|
b1bd9f |
+
|
|
|
b1bd9f |
+ if ( UnTrustedScript(_rScriptURL) )
|
|
|
b1bd9f |
+ return ERRCODE_IO_ACCESSDENIED;
|
|
|
b1bd9f |
+
|
|
|
b1bd9f |
// obtain/create a script provider
|
|
|
b1bd9f |
Reference< provider::XScriptProvider > xScriptProvider;
|
|
|
b1bd9f |
Reference< provider::XScriptProviderSupplier > xSPS( _rxScriptContext, UNO_QUERY );
|
|
|
b1bd9f |
--
|
|
|
b1bd9f |
2.20.1
|
|
|
b1bd9f |
|