From 77519d83eb796f75d73e872356e4100017673653 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 17 Jul 2018 09:08:51 +0100
Subject: bubble referer to LinkManager::GetGraphicFromAny
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Id2c6d629692a365f96f3f81c5686930668389a6a
Reviewed-on: https://gerrit.libreoffice.org/57546
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 sfx2/source/appl/linkmgr2.cxx | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'sfx2')

diff --git a/sfx2/source/appl/linkmgr2.cxx b/sfx2/source/appl/linkmgr2.cxx
index 64e89a927f12..b503e06f0cf6 100644
--- a/sfx2/source/appl/linkmgr2.cxx
+++ b/sfx2/source/appl/linkmgr2.cxx
@@ -40,6 +40,7 @@
 #include <sfx2/request.hxx>
 #include <vcl/dibtools.hxx>
 #include <unotools/charclass.hxx>
+#include <unotools/securityoptions.hxx>
 #include <vcl/GraphicLoader.hxx>
 
 #include "fileobj.hxx"
@@ -497,9 +498,10 @@ SotClipboardFormatId LinkManager::RegisterStatusInfoId()
     return nFormat;
 }
 
-bool LinkManager::GetGraphicFromAny( const OUString& rMimeType,
-                                const css::uno::Any & rValue,
-                                Graphic& rGraphic )
+bool LinkManager::GetGraphicFromAny(const OUString& rMimeType,
+                                    const css::uno::Any & rValue,
+                                    const OUString& rReferer,
+                                    Graphic& rGraphic )
 {
     bool bRet = false;
 
@@ -509,7 +511,8 @@ bool LinkManager::GetGraphicFromAny( const OUString& rMimeType,
     if (rValue.has<OUString>())
     {
         OUString sURL = rValue.get<OUString>();
-        rGraphic = vcl::graphic::loadFromURL(sURL);
+        if (!SvtSecurityOptions().isUntrustedReferer(rReferer))
+            rGraphic = vcl::graphic::loadFromURL(sURL);
         if (!rGraphic)
             rGraphic.SetDefaultType();
         rGraphic.setOriginURL(sURL);
-- 
cgit