From 061d58bc0fa016cfeed744fd3e4663460635d69b Mon Sep 17 00:00:00 2001 From: Simon Hausmann Date: Fri, 23 Nov 2012 15:08:59 +0100 Subject: Imported WebKit commit 8eb048315f36fa33731f28694630fe4a3c2cbc99 (http://svn.webkit.org/repository/webkit/trunk@135602) New snapshot that fixes various bugs Change-Id: Icb6ce541a26a9f500d087821ce4b83a8d8a5474a Reviewed-by: Simon Hausmann --- Source/WebCore/html/HTMLPlugInImageElement.cpp | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) (limited to 'Source/WebCore/html/HTMLPlugInImageElement.cpp') diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp index f1720b8d5..b809a1340 100644 --- a/Source/WebCore/html/HTMLPlugInImageElement.cpp +++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp @@ -88,28 +88,13 @@ bool HTMLPlugInImageElement::isImageType() // depending on values. bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url) { - ASSERT(document()); - ASSERT(document()->frame()); - if (document()->frame()->page()->subframeCount() >= Page::maxNumberOfFrames) - return false; - KURL completeURL = document()->completeURL(url); - + if (contentFrame() && protocolIsJavaScript(completeURL) && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin())) return false; - - // We allow one level of self-reference because some sites depend on that. - // But we don't allow more than one. - bool foundSelfReference = false; - for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) { - if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) { - if (foundSelfReference) - return false; - foundSelfReference = true; - } - } - return true; + + return document()->frame()->isURLAllowed(completeURL); } // We don't use m_url, or m_serviceType as they may not be the final values -- cgit v1.2.1