Bug 1193093 - Tighten up these checks a little. r=Gijs

This commit is contained in:
Blake Kaplan 2016-02-23 16:11:53 -08:00
parent 749b04b187
commit 45ecbb97fc

View File

@ -157,10 +157,11 @@ const Utils = {
// We also reject handlers registered from a different host (see bug 402287)
// The pref allows us to test the feature
let pb = Services.prefs;
if ((!pb.prefHasUserValue(PREF_ALLOW_DIFFERENT_HOST) ||
!pb.getBoolPref(PREF_ALLOW_DIFFERENT_HOST)) &&
aContentWindow.location.hostname != uri.host)
if (!pb.getBoolPref(PREF_ALLOW_DIFFERENT_HOST) &&
(!["http:", "https:"].includes(aContentWindow.location.protocol) ||
aContentWindow.location.hostname != uri.host)) {
throw("Permission denied to add " + uri.spec + " as a content or protocol handler");
}
// If the uri doesn't contain '%s', it won't be a good handler
if (uri.spec.indexOf("%s") < 0)