Fixed: #1334 Applied Ulukyn's patch. Adds two new config variables - WebIgMainDomain and WebIgTrustedDomains.

code/ryzom/client/src/client_cfg.cpp

@@ -426,8 +426,12 @@ CClientConfig::CClientConfig()
 	PatchUrl = "";
 	PatchVersion = "";
 	PatchServer = "";
-	RingReleaseNotePath = "http://atys.ryzom.com/releasenotes_ring/index.php";
+
-	ReleaseNotePath = "http://atys.ryzom.com/releasenotes/index.php";
+	WebIgMainDomain = "atys.ryzom.com";
+	WebIgTrustedDomains.push_back(WebIgMainDomain);
+
+	RingReleaseNotePath = "http://"+WebIgMainDomain+"/releasenotes_ring/index.php";
+	ReleaseNotePath = "http://"+WebIgMainDomain+"/releasenotes/index.php";
 
 	///////////////
 	// ANIMATION //
@@ -1040,6 +1044,11 @@ void CClientConfig::setValues()
 	READ_STRING_DEV(ReleaseNotePath)
 	READ_STRING_FV(PatchServer)
 
+	////////////////////////
+	// WEBIG //
+	READ_STRING_DEV(WebIgMainDomain);
+	READ_STRINGVECTOR_FV(WebIgTrustedDomains);
+
 	///////////////
 	// ANIMATION //
 	// AnimatedAngleThreshold

code/ryzom/client/src/client_cfg.h

@@ -292,6 +292,10 @@ struct CClientConfig
 	std::string		RingReleaseNotePath;
 	std::string		ReleaseNotePath;
 
+	////////////////////////
+	// WEBIG //
+	std::string		WebIgMainDomain;
+	std::vector<string>	WebIgTrustedDomains;
 
 	///////////////
 	// ANIMATION //

code/ryzom/client/src/interface_v3/action_handler_ui.cpp

@@ -416,7 +416,7 @@ class CAHUIShowHide : public IActionHandler
 					nlwarning("%s is not a group html", window.c_str());
 					return;
 				}
-				pGH->setURL("http://atys.ryzom.com/start/index.php?app="+webapp);
+				pGH->setURL("http://"+ClientCfg.WebIgMainDomain+"/start/index.php?app="+webapp);
 			}
 		}
 		else

code/ryzom/client/src/interface_v3/group_html.cpp

@@ -63,6 +63,13 @@ using namespace NLMISC;
 CGroupHTML *CGroupHTML::_ConnectingLock = NULL;
 extern CActionsContext ActionsContext;
 
+// Check if domain is on TrustedDomain	
+bool CGroupHTML::isTrustedDomain(const string &domain) {
+	vector<string>::iterator it;
+	it = find (ClientCfg.WebIgTrustedDomains.begin(), ClientCfg.WebIgTrustedDomains.end(), domain);
+	return it != ClientCfg.WebIgTrustedDomains.end();
+}
+
 // Get an url and return the local filename with the path where the url image should be
 string CGroupHTML::localImageName(const string &url)
 {
@@ -215,6 +222,9 @@ bool CGroupHTML::addBnpDownload(const string &url, const string &action, const s
 
 void CGroupHTML::initBnpDownload()
 {
+	if (!_TrustedDomain)
+		return;
+
 #ifdef LOG_DL
 	nlwarning("Init Bnp Download");
 #endif
@@ -452,7 +462,7 @@ void CGroupHTML::addText (const char * buf, int len)
 //		for (i=0; i<(uint)len; i++)
 //			inputString[i] = buf[i];
 
-		if (_ParsingLua)
+		if (_ParsingLua && _TrustedDomain)
 		{
 			// we are parsing a lua script
 			_LuaScript += inputString;
@@ -523,12 +533,12 @@ void CGroupHTML::addLink (uint element_number, uint /* attribute_number */, HTCh
 			if (present[MY_HTML_A_HREF] && value[MY_HTML_A_HREF])
 			{
 				string suri = value[MY_HTML_A_HREF];
-				if(suri.find("ah:") == 0)
+				if(_TrustedDomain && suri.find("ah:") == 0)
 				{
 					// in ah: command we don't respect the uri standard so the HTAnchor_address doesn't work correctly
 					_Link.push_back (suri);
 				}
-				else if (suri[0] == '#')
+				else if (_TrustedDomain && suri[0] == '#')
 				{
 					// Direct url (hack for lua beginElement)
 					_Link.push_back (suri.substr(1));	
@@ -822,7 +832,7 @@ void CGroupHTML::beginElement (uint element_number, const BOOL *present, const c
 			_A.push_back(true);
 
 			// Quick help
-			if (present[MY_HTML_A_Z_ACTION_SHORTCUT] && value[MY_HTML_A_Z_ACTION_SHORTCUT])
+			if (_TrustedDomain && present[MY_HTML_A_Z_ACTION_SHORTCUT] && value[MY_HTML_A_Z_ACTION_SHORTCUT])
 			{
 				// Get the action category
 				string category;
@@ -1532,19 +1542,23 @@ void CGroupHTML::endElement (uint element_number)
 			_IgnoreText = false;
 			break;
 		case HTML_OBJECT:
-			if (_ObjectType=="application/ryzom-data")
+			if (_TrustedDomain)
 			{
-				if (!_ObjectData.empty())
+				if (_ObjectType=="application/ryzom-data")
 				{
-					if (addBnpDownload(_ObjectData, _ObjectAction, _ObjectScript, _ObjectMD5Sum))
+					if (!_ObjectData.empty())
 					{
-						CInterfaceManager *pIM = CInterfaceManager::getInstance();
+						if (addBnpDownload(_ObjectData, _ObjectAction, _ObjectScript, _ObjectMD5Sum))
-						pIM->executeLuaScript(_ObjectScript, true);
+						{
+							CInterfaceManager *pIM = CInterfaceManager::getInstance();
+							pIM->executeLuaScript(_ObjectScript, true);
+						}
+						_ObjectScript = "";
 					}
-					_ObjectScript = "";
 				}
+				_Object = false;
 			}
-			_Object = false;
+			break;
 		}
 	}
 }
@@ -1556,7 +1570,7 @@ void CGroupHTML::beginUnparsedElement(const char *buffer, int length)
 	if (stricmp(str.c_str(), "lua") == 0)
 	{
 		// we receive an embeded lua script
-		_ParsingLua = true;
+		_ParsingLua = _TrustedDomain; // Only parse lua if TrustedDomain
 		_LuaScript = "";
 	}
 }
@@ -1567,7 +1581,7 @@ void CGroupHTML::endUnparsedElement(const char *buffer, int length)
 	string str(buffer, buffer+length);
 	if (stricmp(str.c_str(), "lua") == 0)
 	{
-		if (_ParsingLua)
+		if (_ParsingLua && _TrustedDomain)
 		{
 			_ParsingLua = false;
 			// execute the embeded lua script
@@ -2894,7 +2908,7 @@ void CGroupHTML::handle ()
 
 				// Init LibWWW
 				initLibWWW();
-				setCurrentDomain(finalUrl);
+				_TrustedDomain = isTrustedDomain(setCurrentDomain(finalUrl));
 
 				// Get the final URL
 				C3WSmartPtr uri = HTParse(finalUrl.c_str(), NULL, PARSE_ALL);
@@ -3045,7 +3059,7 @@ void CGroupHTML::handle ()
 
 				// Init LibWWW
 				initLibWWW();
-				setCurrentDomain(_URL);
+				_TrustedDomain = isTrustedDomain(setCurrentDomain(_URL));
 
 				// Get the final URL
 				C3WSmartPtr uri = HTParse(_URL.c_str(), NULL, PARSE_ALL);

code/ryzom/client/src/interface_v3/group_html.h

@@ -281,6 +281,9 @@ protected :
 	// Current URL
 	std::string		_URL;
 
+	// Current DOMAIN
+	bool			_TrustedDomain;
+
 	// Title prefix
 	ucstring		_TitlePrefix;
 
@@ -579,6 +582,7 @@ private:
 	void checkImageDownload();
 	void addImageDownload(const std::string &url, CViewBase *img);
 	std::string localImageName(const std::string &url);
+	bool isTrustedDomain(const std::string &domain);
 
 
 

code/ryzom/client/src/interface_v3/group_html_webig.cpp

@@ -203,8 +203,7 @@ struct CWebigNotificationThread : public NLMISC::IRunnable
 		nlSleep(1*60*1000);
 		while (true)
 		{
-			string url = "http://atys.ryzom.com/start/index.php?app=notif&rnd="+randomString();
+			string url = "http://"+ClientCfg.WebIgMainDomain+"/start/index.php?app=notif&rnd="+randomString();
-			//string url = "http://ryapp.bmsite.net/app_mail.php?page=ajax/inbox/unread&rnd="+randomString();
 			addWebIGParams(url);
 			get(url);
 			nlSleep(10*60*1000);

code/ryzom/client/src/libwww.cpp

@@ -520,7 +520,7 @@ int HTMIME_location_custom (HTRequest * request, HTResponse * response, char * t
 
 // ***************************************************************************
 
-void setCurrentDomain(const std::string &url)
+const std::string &setCurrentDomain(const std::string &url)
 {
 	if(url.find("http://") == 0)
 	{
@@ -532,6 +532,7 @@ void setCurrentDomain(const std::string &url)
 		HTTPCurrentDomain.clear();
 //		nlinfo("****cd: clear the domain");
 	}
+	return HTTPCurrentDomain;
 }
 
 void initLibWWW()

code/ryzom/client/src/libwww.h

@@ -35,7 +35,7 @@ class CCtrlBaseButton;
 void initLibWWW();
 
 // Get an url and setup a local domain
-void setCurrentDomain(const std::string &url);
+const std::string &setCurrentDomain(const std::string &url);
 
 extern std::string CurrentCookie;
 

code/ryzom/client/src/net_manager.cpp

@@ -3253,7 +3253,7 @@ private:
 			if(i != digitMaxEnd)
 			{
 				ucstring web_app = contentStr.substr(digitStart, i-digitStart);
-				contentStr = ucstring("http://atys.ryzom.com/start/")+web_app+ucstring(".php?")+contentStr.substr(i+1);
+				contentStr = ucstring("http://"+ClientCfg.WebIgMainDomain+"/start/")+web_app+ucstring(".php?")+contentStr.substr(i+1);
 			}
 			else
 			{