Sakurai/pdf.js
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #6916 from yurydelendik/hosted-viewer

Browse Source 
Allow foriegn origin URLs only for hosted viewers.
This commit is contained in:
Brendan Dahl 2016-01-22 10:02:52 -08:00
commit 059e826e20
1 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
web/viewer.js
View File

@ -1332,6 +1332,37 @@ window.PDFView = PDFViewerApplication; // obsolete name, using it as an alias
//})();
//#endif
//#if GENERIC
var HOSTED_VIEWER_ORIGINS = ['null',
'http://mozilla.github.io', 'https://mozilla.github.io'];
function validateFileURL(file) {
try {
var viewerOrigin = new URL(window.location.href).origin || 'null';
if (HOSTED_VIEWER_ORIGINS.indexOf(viewerOrigin) >= 0) {
// Hosted or local viewer, allow for any file locations
return;
}
var fileOrigin = new URL(file, window.location.href).origin;
// Removing of the following line will not guarantee that the viewer will
// start accepting URLs from foreign origin -- CORS headers on the remote
// server must be properly configured.
if (fileOrigin !== viewerOrigin) {
throw new Error('file origin does not match viewer\'s');
}
} catch (e) {
var message = e && e.message;
var loadingErrorMessage = mozL10n.get('loading_error', null,
'An error occurred while loading the PDF.');
var moreInfo = {
message: message
};
PDFViewerApplication.error(loadingErrorMessage, moreInfo);
throw e;
}
}
//#endif
function webViewerLoad(evt) {
//#if !PRODUCTION
require.config({paths: {'pdfjs': '../src'}});
@ -1351,6 +1382,7 @@ function webViewerInitialized() {
var queryString = document.location.search.substring(1);
var params = parseQueryString(queryString);
var file = 'file' in params ? params.file : DEFAULT_URL;
validateFileURL(file);
//#endif
//#if (FIREFOX || MOZCENTRAL)
//var file = window.location.href.split('#')[0];