diff options
| author | Joe Fernandez <joefernandez@google.com> | 2015-04-23 17:57:02 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-04-23 17:57:02 +0000 |
| commit | 78cb6f5458fb5dd6c782b38a393515993e88c84b (patch) | |
| tree | edcb5d6e97855ec4184ebe9f739a23ba2f0dafbe | |
| parent | be3d85fb96cf1634b05dbaad708127219d5e8ced (diff) | |
| parent | 1009c8de23920c4a368edf7f1e2ecde63e40ec82 (diff) | |
| download | frameworks_base-78cb6f5458fb5dd6c782b38a393515993e88c84b.zip frameworks_base-78cb6f5458fb5dd6c782b38a393515993e88c84b.tar.gz frameworks_base-78cb6f5458fb5dd6c782b38a393515993e88c84b.tar.bz2 | |
am 1009c8de: am 92ae292e: Merge "docs: Add text to JavaDocs regarding browser file access vulnerability" into lmp-mr1-ub-docs
* commit '1009c8de23920c4a368edf7f1e2ecde63e40ec82':
docs: Add text to JavaDocs regarding browser file access vulnerability
| -rw-r--r-- | core/java/android/webkit/WebSettings.java | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java index 943beb0..453e4f5 100644 --- a/core/java/android/webkit/WebSettings.java +++ b/core/java/android/webkit/WebSettings.java @@ -900,7 +900,9 @@ public abstract class WebSettings { * and therefore secure policy, this setting should be disabled. * Note that this setting affects only JavaScript access to file scheme * resources. Other access to such resources, for example, from image HTML - * elements, is unaffected. + * elements, is unaffected. To prevent possible violation of same domain policy + * on {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH} and earlier + * devices, you should explicitly set this value to {@code false}. * <p> * The default value is true for API level * {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH_MR1} and below, @@ -920,7 +922,9 @@ public abstract class WebSettings { * the value of {@link #getAllowUniversalAccessFromFileURLs} is true. * Note too, that this setting affects only JavaScript access to file scheme * resources. Other access to such resources, for example, from image HTML - * elements, is unaffected. + * elements, is unaffected. To prevent possible violation of same domain policy + * on {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH} and earlier + * devices, you should explicitly set this value to {@code false}. * <p> * The default value is true for API level * {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH_MR1} and below, |