From a567c425cab9b7aff8acee11aaf3470187675271 Mon Sep 17 00:00:00 2001
From: Maestro Linden <maestro@lindenlab.com>
Date: Wed, 14 Nov 2012 02:24:58 +0000
Subject: MAINT-536 MAINT-1913 Added missing URL scheme filtering to the Linux
 viewer, changed URL scheme whitelist. Reviewed by Callum.

---
 indra/llwindow/llwindow.cpp    |  7 ++++---
 indra/llwindow/llwindow.h      |  2 +-
 indra/llwindow/llwindowsdl.cpp | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 4 deletions(-)

(limited to 'indra/llwindow')

diff --git a/indra/llwindow/llwindow.cpp b/indra/llwindow/llwindow.cpp
index 5b7424acbb..93b9d36939 100644
--- a/indra/llwindow/llwindow.cpp
+++ b/indra/llwindow/llwindow.cpp
@@ -50,14 +50,15 @@ LLSplashScreen *gSplashScreenp = NULL;
 BOOL gDebugClicks = FALSE;
 BOOL gDebugWindowProc = FALSE;
 
-const S32 gURLProtocolWhitelistCount = 3;
-const std::string gURLProtocolWhitelist[] = { "file:", "http:", "https:" };
+const S32 gURLProtocolWhitelistCount = 4;
+const std::string gURLProtocolWhitelist[] = { "secondlife:", "http:", "https:", "data:" };
 
 // CP: added a handler list - this is what's used to open the protocol and is based on registry entry
 //	   only meaningful difference currently is that file: protocols are opened using http:
 //	   since no protocol handler exists in registry for file:
 //     Important - these lists should match - protocol to handler
-const std::string gURLProtocolWhitelistHandler[] = { "http", "http", "https" };	
+// Maestro: This list isn't referenced anywhere that I could find
+//const std::string gURLProtocolWhitelistHandler[] = { "http", "http", "https" };	
 
 
 S32 OSMessageBox(const std::string& text, const std::string& caption, U32 type)
diff --git a/indra/llwindow/llwindow.h b/indra/llwindow/llwindow.h
index 4da87f4e06..e9147d552e 100644
--- a/indra/llwindow/llwindow.h
+++ b/indra/llwindow/llwindow.h
@@ -280,7 +280,7 @@ extern BOOL gDebugWindowProc;
 // Protocols, like "http" and "https" we support in URLs
 extern const S32 gURLProtocolWhitelistCount;
 extern const std::string gURLProtocolWhitelist[];
-extern const std::string gURLProtocolWhitelistHandler[];
+//extern const std::string gURLProtocolWhitelistHandler[];
 
 void simpleEscapeString ( std::string& stringIn  );
 
diff --git a/indra/llwindow/llwindowsdl.cpp b/indra/llwindow/llwindowsdl.cpp
index 3bf4a48cb6..5afe0b0953 100644
--- a/indra/llwindow/llwindowsdl.cpp
+++ b/indra/llwindow/llwindowsdl.cpp
@@ -2516,6 +2516,23 @@ void exec_cmd(const std::string& cmd, const std::string& arg)
 // Must begin with protocol identifier.
 void LLWindowSDL::spawnWebBrowser(const std::string& escaped_url, bool async)
 {
+	bool found = false;
+	S32 i;
+	for (i = 0; i < gURLProtocolWhitelistCount; i++)
+	{
+		if (escaped_url.find(gURLProtocolWhitelist[i]) != std::string::npos)
+		{
+			found = true;
+			break;
+		}
+	}
+
+	if (!found)
+	{
+		llwarns << "spawn_web_browser called for url with protocol not on whitelist: " << escaped_url << llendl;
+		return;
+	}
+
 	llinfos << "spawn_web_browser: " << escaped_url << llendl;
 	
 #if LL_LINUX || LL_SOLARIS
-- 
cgit v1.2.3