26 lines
1.2 KiB
Diff
26 lines
1.2 KiB
Diff
diff -up qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp.me qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp
|
|
--- qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp.me 2010-05-06 11:29:24.000000000 +0200
|
|
+++ qt-everywhere-opensource-src-4.6.2/src/3rdparty/webkit/WebCore/page/SecurityOrigin.cpp 2010-05-06 11:43:29.000000000 +0200
|
|
@@ -112,7 +112,11 @@ SecurityOrigin::SecurityOrigin(const KUR
|
|
|
|
// By default, only local SecurityOrigins can load local resources.
|
|
m_canLoadLocalResources = isLocal();
|
|
-
|
|
+ if (m_canLoadLocalResources) {
|
|
+ // Directories should never be readable.
|
|
+ if (!url.hasPath() || url.path().endsWith("/"))
|
|
+ m_noAccess = true;
|
|
+ }
|
|
if (isDefaultPortForProtocol(m_port, m_protocol))
|
|
m_port = 0;
|
|
}
|
|
@@ -207,6 +211,8 @@ bool SecurityOrigin::canRequest(const KU
|
|
return false;
|
|
|
|
RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
|
|
+ if (targetOrigin->m_noAccess)
|
|
+ return false;
|
|
|
|
// We call isSameSchemeHostPort here instead of canAccess because we want
|
|
// to ignore document.domain effects.
|