Merge lp:~mardy/signon-ui/lp1074733 into lp:signon-ui/12.10

[Alberto Mardegan]

Allow fine grained control over which URLs are allowed

We already have a couple of regexp to whitelist and blacklist URLs, but those
are stripped of the schema and fragment.
To be able to implement more complex logics, and whitelist some specific
http-only urls, we need a regular expression which takes the schema into
account.

[David King (amigadave)]

review: Approve

=== modified file 'src/browser-request.cpp'
--- src/browser-request.cpp	2012-09-12 10:19:48 +0000
+++ src/browser-request.cpp	2012-11-09 11:15:26 +0000
@@ -56,6 +56,7 @@
 static const QString keyLoginButton = QString("LoginButton");
 static const QString keyInternalLinksPattern = QString("InternalLinksPattern");
 static const QString keyExternalLinksPattern = QString("ExternalLinksPattern");
+static const QString keyAllowedUrls = QString("AllowedUrls");
 
 /* Additional session-data keys we support. */
 static const QString keyCookies = QString("Cookies");
@@ -85,6 +86,11 @@
         m_allowedSchemes = schemes;
     }
 
+    void setAllowedUrls(const QString &pattern) {
+        m_allowedUrls =
+            QRegExp(pattern, Qt::CaseInsensitive, QRegExp::RegExp2);
+    }
+
     void setFinalUrl(const QUrl &url) { m_finalUrl = url; }
 
 protected:
@@ -135,6 +141,7 @@
     QRegExp m_externalLinksPattern;
     QRegExp m_internalLinksPattern;
     QStringList m_allowedSchemes;
+    QRegExp m_allowedUrls;
     QUrl m_finalUrl;
 };
 
@@ -144,6 +151,12 @@
         return true;
     }
 
+    if (!m_allowedUrls.isEmpty() &&
+        !m_allowedUrls.exactMatch(url.toString())) {
+        TRACE() << "URL not allowed:" << url;
+        return true;
+    }
+
     QString urlText = url.toString(QUrl::RemoveScheme |
                                    QUrl::RemoveUserInfo |
                                    QUrl::RemoveFragment |
@@ -606,6 +619,7 @@
                                   toString());
     page->setInternalLinksPattern(m_settings->value(keyInternalLinksPattern).
                                   toString());
+    page->setAllowedUrls(m_settings->value(keyAllowedUrls).toString());
 }
 
 void BrowserRequestPrivate::notifyAuthCompleted()