Backup_Repos/calibre
1
0
Fork 0
mirror of git://github.com/kovidgoyal/calibre.git synced 2026-04-29 03:32:58 +02:00
Code Issues Projects Releases Wiki Activity

Sandboxed network requests must start with book/

Browse source
This commit is contained in:
Kovid Goyal 2019-10-16 07:03:33 +05:30
parent a8bd8f806d
commit df2756faa3
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/calibre/gui2/viewer/web_view.py
View file

@ -40,6 +40,7 @@
except ImportError:
import sip
SANDBOX_HOST = FAKE_HOST.rpartition('.')[0] + '.sandbox'
vprefs = JSONConfig('viewer-webengine')
viewer_config_dir = os.path.join(config_dir, 'viewer')
vprefs.defaults['session_data'] = {}
@ -116,17 +117,21 @@ def __init__(self, parent=None):
QWebEngineUrlSchemeHandler.__init__(self, parent)
self.mathjax_dir = P('mathjax', allow_user_override=False)
self.mathjax_manifest = None
self.allowed_hosts = (FAKE_HOST, FAKE_HOST.rpartition('.')[0] + '.sandbox')
self.allowed_hosts = (FAKE_HOST, SANDBOX_HOST)
def requestStarted(self, rq):
if bytes(rq.requestMethod()) != b'GET':
rq.fail(rq.RequestDenied)
return
url = rq.requestUrl()
if url.host() not in self.allowed_hosts or url.scheme() != FAKE_PROTOCOL:
host = url.host()
if host not in self.allowed_hosts or url.scheme() != FAKE_PROTOCOL:
rq.fail(rq.UrlNotFound)
return
name = url.path()[1:]
if host == SANDBOX_HOST and not name.startswith('book/'):
rq.fail(rq.UrlNotFound)
return
if name.startswith('book/'):
name = name.partition('/')[2]
if name == '__index__':