Merge pull request #7843 from sethalves/fix-stanard-library-include-some-more

make Script.include(/~/system/libraries/utils.js) work from web again
This commit is contained in:
Brad Hefta-Gaub 2016-05-10 08:17:08 -07:00
commit 573f6f3faa

View file

@ -995,7 +995,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac
}
QList<QUrl> urls;
bool knowsSensitivity = false;
Qt::CaseSensitivity sensitivity;
Qt::CaseSensitivity sensitivity { Qt::CaseSensitive };
auto getSensitivity = [&]() {
if (!knowsSensitivity) {
QString path = currentSandboxURL.path();
@ -1012,6 +1012,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac
const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment;
for (QString file : includeFiles) {
QUrl thisURL;
bool isStandardLibrary = false;
if (file.startsWith("/~/")) {
thisURL = expandScriptUrl(QUrl::fromLocalFile(expandScriptPath(file)));
QUrl defaultScriptsLoc = defaultScriptsLocation();
@ -1019,21 +1020,17 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac
qDebug() << "ScriptEngine::include -- skipping" << file << "-- outside of standard libraries";
continue;
}
isStandardLibrary = true;
} else {
thisURL = resolvePath(file);
}
if (!_includedURLs.contains(thisURL)) {
if (!currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") &&
(
(currentSandboxURL.scheme() != "file") ||
(
!thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) &&
!thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity())
)
)
) {
qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL;
if (!isStandardLibrary && !currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") &&
(currentSandboxURL.scheme() != "file" ||
!thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()))) {
qCWarning(scriptengine) << "Script.include() ignoring file path"
<< thisURL << "outside of original entity script" << currentSandboxURL;
} else {
// We could also check here for CORS, but we don't yet.
// It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here.