diff options
| author | Joe Fernandez <joefernandez@google.com> | 2015-04-23 17:33:17 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-04-23 17:33:18 +0000 |
| commit | 92ae292e864287abcb1a78c117263f64b303b885 (patch) | |
| tree | 619fd95b82b0be9eb18655ffddb1bdb683ee3ea3 /core/java/android/webkit/WebSettings.java | |
| parent | 674b06481dc73ce64116b885eb97266f956b614d (diff) | |
| parent | 22b5ba8c0140c4c675cdf5093514083a475cd7b4 (diff) | |
| download | frameworks_base-92ae292e864287abcb1a78c117263f64b303b885.zip frameworks_base-92ae292e864287abcb1a78c117263f64b303b885.tar.gz frameworks_base-92ae292e864287abcb1a78c117263f64b303b885.tar.bz2 | |
Merge "docs: Add text to JavaDocs regarding browser file access vulnerability" into lmp-mr1-ub-docs
Diffstat (limited to 'core/java/android/webkit/WebSettings.java')
| -rw-r--r-- | core/java/android/webkit/WebSettings.java | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java index 1d2c311..ef9aaf1 100644 --- a/core/java/android/webkit/WebSettings.java +++ b/core/java/android/webkit/WebSettings.java @@ -900,7 +900,9 @@ public abstract class WebSettings { * and therefore secure policy, this setting should be disabled. * Note that this setting affects only JavaScript access to file scheme * resources. Other access to such resources, for example, from image HTML - * elements, is unaffected. + * elements, is unaffected. To prevent possible violation of same domain policy + * on {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH} and earlier + * devices, you should explicitly set this value to {@code false}. * <p> * The default value is true for API level * {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH_MR1} and below, @@ -920,7 +922,9 @@ public abstract class WebSettings { * the value of {@link #getAllowUniversalAccessFromFileURLs} is true. * Note too, that this setting affects only JavaScript access to file scheme * resources. Other access to such resources, for example, from image HTML - * elements, is unaffected. + * elements, is unaffected. To prevent possible violation of same domain policy + * on {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH} and earlier + * devices, you should explicitly set this value to {@code false}. * <p> * The default value is true for API level * {@link android.os.Build.VERSION_CODES#ICE_CREAM_SANDWICH_MR1} and below, |