Mirrors/overte-lubosz
3
0
Fork 0
mirror of https://github.com/lubosz/overte.git synced 2025-08-04 19:39:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

use isParentOf to check script whitelist, clarify description in settings

Browse source
This commit is contained in:
Stephen Birarda 2017-01-23 16:33:22 -08:00
parent db398b7850
commit 7362bf16c1
2 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
domain-server/resources/describe-settings.json
View file

@ -1285,7 +1285,7 @@
{ {
"name": "entityScriptSourceWhitelist", "name": "entityScriptSourceWhitelist",
"label": "Entity Scripts Allowed from:", "label": "Entity Scripts Allowed from:",
"help": "The domains that entity scripts are allowed from. A comma separated list of domains that entity scripts are allowed from, if someone attempts to create and entity or edit an entity to have a different domain, it will be rejected. If left blank, any domain is allowed.", "help": "Comma separated list of URLs (with optional paths) that entity scripts are allowed from. If someone attempts to create and entity or edit an entity to have a different domain, it will be rejected. If left blank, any domain is allowed.",
"placeholder": "", "placeholder": "",
"default": "", "default": "",
"advanced": true "advanced": true

12
libraries/entities/src/EntityTree.cpp
View file

@ -963,7 +963,17 @@ int EntityTree::processEditPacketData(ReceivedMessage& message, const unsigned c
auto entityScriptURL = QUrl::fromUserInput(properties.getScript()); auto entityScriptURL = QUrl::fromUserInput(properties.getScript());
for (const auto& whiteListedPrefix : _entityScriptSourceWhitelist) { for (const auto& whiteListedPrefix : _entityScriptSourceWhitelist) {
if (entityScriptURL.host().compare(whiteListedPrefix, Qt::CaseInsensitive) == 0) { auto whiteListURL = QUrl::fromUserInput(whiteListedPrefix);
if (entityScriptURL.scheme() != whiteListURL.scheme()) {
// isParentOf will be false if the schemes are different, but
}
qDebug() << "Comparing" << entityScriptURL << "to" << whiteListURL;
qDebug() << whiteListURL.isParentOf(entityScriptURL);
// check if this script URL matches the whitelist domain and, optionally, is beneath the path
if (whiteListURL.isParentOf(entityScriptURL)) {
passedWhiteList = true; passedWhiteList = true;
break; break;
} }