Reviewed by Ken and Maciej.

        - fixed <rdar://problem/4049040> REGRESSION (403-405): security check prevents user stylesheet from loading (Dictionary.app doesn't work at all!)

        * Plugins.subproj/WebNetscapePluginStream.m: (-[WebNetscapePluginStream initWithRequest:pluginPointer:notifyData:sendNotification:]):
        Allow plug-in subresource streams to load with any URL, ignoring the "canLoadURL" method's restriction (only
        file URLs can load other file URLs), which now applies only to main resources, like web pages in frames or
        object tags and plug-in main resources.

        * WebCoreSupport.subproj/WebBridge.m:
        (-[WebBridge startLoadingResource:withURL:customHeaders:]): Allow subresources to load with any URL, as above.
        This allows things like images, stylesheets, and JavaScript to be loaded without the "canLoadURL" method's
        restriction.
        (-[WebBridge startLoadingResource:withURL:customHeaders:postData:]): Ditto.
        (-[WebBridge syncLoadResourceWithURL:customHeaders:postData:finalURL:responseHeaders:statusCode:]): Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@8874 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 7bacf9414e10a78e294b31b04f490367b146bec9..fc83bfe5fe116a013e44eea838b8ebde47ddc824 100644 (file)
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,21 @@
+2005-03-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken and Maciej.
+
+        - fixed <rdar://problem/4049040> REGRESSION (403-405): security check prevents user stylesheet from loading (Dictionary.app doesn't work at all!)
+
+        * Plugins.subproj/WebNetscapePluginStream.m: (-[WebNetscapePluginStream initWithRequest:pluginPointer:notifyData:sendNotification:]):
+        Allow plug-in subresource streams to load with any URL, ignoring the "canLoadURL" method's restriction (only
+        file URLs can load other file URLs), which now applies only to main resources, like web pages in frames or
+        object tags and plug-in main resources.
+
+        * WebCoreSupport.subproj/WebBridge.m:
+        (-[WebBridge startLoadingResource:withURL:customHeaders:]): Allow subresources to load with any URL, as above.
+        This allows things like images, stylesheets, and JavaScript to be loaded without the "canLoadURL" method's
+        restriction.
+        (-[WebBridge startLoadingResource:withURL:customHeaders:postData:]): Ditto.
+        (-[WebBridge syncLoadResourceWithURL:customHeaders:postData:finalURL:responseHeaders:statusCode:]): Ditto.
+
 2005-03-10  Richard Williamson   <rjw@apple.com>
 
        Fixed <rdar://problem/4040321> Exception: Someone's trying to encode a WebDataRequestParameters instance 

diff --git a/WebKit/Plugins.subproj/WebNetscapePluginStream.m b/WebKit/Plugins.subproj/WebNetscapePluginStream.m
index 3072c6d1f645f0a2f71b7b4dc14d9046e2742534..90123f0682338a500ac23c9378e7e54a2433f0fe 100644 (file)
--- a/WebKit/Plugins.subproj/WebNetscapePluginStream.m
+++ b/WebKit/Plugins.subproj/WebNetscapePluginStream.m
@@ -38,9 +38,11 @@
     WebBaseNetscapePluginView *view = (WebBaseNetscapePluginView *)thePluginPointer->ndata;
 
     WebBridge *bridge = [[view webFrame] _bridge];
+
+    // Since this is a subresource, we can load any URL (we ignore the return value).
+    // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method.
     BOOL hideReferrer;
-    if (![bridge canLoadURL:[theRequest URL] fromReferrer:[bridge referrer] hideReferrer:&hideReferrer])
-        return nil;
+    [bridge canLoadURL:[theRequest URL] fromReferrer:[bridge referrer] hideReferrer:&hideReferrer];
 
     if ([self initWithRequestURL:[theRequest URL]
                     pluginPointer:thePluginPointer

diff --git a/WebKit/WebCoreSupport.subproj/WebBridge.m b/WebKit/WebCoreSupport.subproj/WebBridge.m
index b54375a552151e6a961bc304419477ae075f9a00..6c5fe553142c7398683a4365bac144bd2bf1cf33 100644 (file)
--- a/WebKit/WebCoreSupport.subproj/WebBridge.m
+++ b/WebKit/WebCoreSupport.subproj/WebBridge.m
@@ -422,9 +422,10 @@ NSString *WebPluginContainerKey =   @"WebPluginContainer";
        return nil;
     }
 
+    // Since this is a subresource, we can load any URL (we ignore the return value).
+    // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method.
     BOOL hideReferrer;
-    if (![self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer])
-        return nil;
+    [self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer];
 
     return [WebSubresourceClient startLoadingResource:resourceLoader
                                               withURL:URL
@@ -441,9 +442,10 @@ NSString *WebPluginContainerKey =   @"WebPluginContainer";
        return nil;
     }
 
+    // Since this is a subresource, we can load any URL (we ignore the return value).
+    // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method.
     BOOL hideReferrer;
-    if (![self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer])
-        return nil;
+    [self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer];
 
     return [WebSubresourceClient startLoadingResource:resourceLoader
                                               withURL:URL
@@ -472,9 +474,10 @@ NSString *WebPluginContainerKey =   @"WebPluginContainer";
 
 - (NSData *)syncLoadResourceWithURL:(NSURL *)URL customHeaders:(NSDictionary *)requestHeaders postData:(NSArray *)postData finalURL:(NSURL **)finalURL responseHeaders:(NSDictionary **)responseHeaderDict statusCode:(int *)statusCode
 {
+    // Since this is a subresource, we can load any URL (we ignore the return value).
+    // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method.
     BOOL hideReferrer;
-    if (![self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer])
-        return nil;
+    [self canLoadURL:URL fromReferrer:[self referrer] hideReferrer:&hideReferrer];
 
     NSMutableURLRequest *newRequest = [[NSMutableURLRequest alloc] initWithURL:URL];