sfx2/source/doc/objmisc.cxx | 13 +++++++++++++
1 file changed, 13 insertions(+)
New commits:
commit cb0024e3668979dfdef44db5aa15ddfaf035e695
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jun 7 14:04:07 2019 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Jun 8 16:18:52 2019 +0200
explictly exclude LibreLogo from XScript usage
Change-Id: I567647f0e2f8b82e4ef2995c673abe82f4564228
Reviewed-on: https://gerrit.libreoffice.org/73659
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 2ece4b9a6e6c..d44b55e6b753 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -1344,6 +1344,16 @@ namespace
}
}
+namespace {
+
+// don't allow LibreLogo to be used with our mouseover/etc dom-alike events
+bool UnTrustedScript(const OUString& rScriptURL)
+{
+ return
rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo");
+}
+
+}
+
ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >&
_rxScriptContext, const OUString& _rScriptURL,
const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >&
aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const
css::uno::Any* pCaller )
{
@@ -1356,6 +1366,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference<
XInterface >& _rxScriptCon
if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow(
_rxScriptContext ) )
return ERRCODE_IO_ACCESSDENIED;
+ if ( UnTrustedScript(_rScriptURL) )
+ return ERRCODE_IO_ACCESSDENIED;
+
bool bCaughtException = false;
Any aException;
try
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
