From f440831d76817e837164ca18c7705e81d2391f87 Mon Sep 17 00:00:00 2001
From: Huahui Wu <hwu@google.com>
Date: Tue, 22 Mar 2011 15:03:31 -0700
Subject: DO NOT MERGE

b/4088884 Backport "Remove content:// protocol handler in web browser"
to Gingerbread

It's a manual cherrypick of
     https://android-git.corp.google.com/g/#change,87278
since a lot has been changed in bettween.

Change-Id: Ic8e3a419571f535bf983f32cd02181ca66d19319
---
 core/java/android/webkit/FrameLoader.java |  3 ++-
 core/java/android/webkit/WebSettings.java | 23 ++++++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/core/java/android/webkit/FrameLoader.java b/core/java/android/webkit/FrameLoader.java
index 7fd993a..ec7c032 100644
--- a/core/java/android/webkit/FrameLoader.java
+++ b/core/java/android/webkit/FrameLoader.java
@@ -182,7 +182,8 @@ class FrameLoader {
                                 settings.getAllowFileAccess())).sendToTarget();
             }
             return true;
-        } else if (URLUtil.isContentUrl(url)) {
+        } else if (settings.getAllowContentAccess() &&
+                   URLUtil.isContentUrl(url)) {
             // Send the raw url to the ContentLoader because it will do a
             // permission check and the url has to match.
             if (loadListener.isSynchronous()) {
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java
index 4d70e7c..89e25e8 100644
--- a/core/java/android/webkit/WebSettings.java
+++ b/core/java/android/webkit/WebSettings.java
@@ -206,6 +206,7 @@ public class WebSettings {
     private boolean         mSupportZoom = true;
     private boolean         mBuiltInZoomControls = false;
     private boolean         mAllowFileAccess = true;
+    private boolean         mAllowContentAccess = true;
     private boolean         mLoadWithOverviewMode = false;
     private boolean         mUseWebViewBackgroundOverscrollBackground = true;
 
@@ -458,7 +459,9 @@ public class WebSettings {
     
     /**
      * Enable or disable file access within WebView. File access is enabled by
-     * default.
+     * default. Note that this enables or disables file system access only.
+     * Assets and resources are still accessible using file:///android_asset and
+     * file:///android_res.
      */
     public void setAllowFileAccess(boolean allow) {
         mAllowFileAccess = allow;
@@ -472,6 +475,24 @@ public class WebSettings {
     }
 
     /**
+     * Enable or disable content url access within WebView.  Content url access
+     * allows WebView to load content from a content provider installed in the
+     * system.  The default is enabled.
+     * @hide
+     */
+    public void setAllowContentAccess(boolean allow) {
+        mAllowContentAccess = allow;
+    }
+
+    /**
+     * Returns true if this WebView supports content url access.
+     * @hide
+     */
+    public boolean getAllowContentAccess() {
+        return mAllowContentAccess;
+    }
+
+    /**
      * Set whether the WebView loads a page with overview mode.
      */
     public void setLoadWithOverviewMode(boolean overview) {
-- 
cgit v1.1