From d1737edc13864b2304763167720b27b68791e25a Mon Sep 17 00:00:00 2001
From: Patrick Scott <phanna@android.com>
Date: Wed, 5 Jan 2011 11:36:48 -0500
Subject: [PATCH] Do not merge.

Cherry picked:

Add an api to toggle content url access.

By default, WebView allows access to content providers on the system.  This
setting allows applications to turn off content urls.

Bug: 1196879
Change-Id: I49eaea6d7b9ccc3b3a4443d712222556087568c0
---
 api/current.xml                            | 24 ++++++++++++++++++++++
 core/java/android/webkit/BrowserFrame.java |  3 ++-
 core/java/android/webkit/FrameLoader.java  |  3 ++-
 core/java/android/webkit/WebSettings.java  | 21 ++++++++++++++++++-
 4 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/api/current.xml b/api/current.xml
index 6371a3222240f..38ee9f635942e 100644
--- a/api/current.xml
+++ b/api/current.xml
@@ -232537,6 +232537,17 @@
  visibility="public"
 >
 </method>
+<method name="getAllowContentAccess"
+ return="boolean"
+ abstract="false"
+ native="false"
+ synchronized="false"
+ static="false"
+ final="false"
+ deprecated="not deprecated"
+ visibility="public"
+>
+</method>
 <method name="getAllowFileAccess"
  return="boolean"
  abstract="false"
@@ -232955,6 +232966,19 @@
  visibility="public"
 >
 </method>
+<method name="setAllowContentAccess"
+ return="void"
+ abstract="false"
+ native="false"
+ synchronized="false"
+ static="false"
+ final="false"
+ deprecated="not deprecated"
+ visibility="public"
+>
+<parameter name="allow" type="boolean">
+</parameter>
+</method>
 <method name="setAllowFileAccess"
  return="void"
  abstract="false"
diff --git a/core/java/android/webkit/BrowserFrame.java b/core/java/android/webkit/BrowserFrame.java
index de1faa21edff5..e246717b7241f 100644
--- a/core/java/android/webkit/BrowserFrame.java
+++ b/core/java/android/webkit/BrowserFrame.java
@@ -738,7 +738,8 @@ class BrowserFrame extends Handler {
             }
 
         // content://
-        } else if (url.startsWith(ANDROID_CONTENT)) {
+        } else if (mSettings.getAllowContentAccess() &&
+                   url.startsWith(ANDROID_CONTENT)) {
             try {
                 // Strip off mimetype, for compatibility with ContentLoader.java
                 // If we don't do this, we can fail to load Gmail attachments,
diff --git a/core/java/android/webkit/FrameLoader.java b/core/java/android/webkit/FrameLoader.java
index 2b4477512a3c5..0d8030285244a 100644
--- a/core/java/android/webkit/FrameLoader.java
+++ b/core/java/android/webkit/FrameLoader.java
@@ -203,7 +203,8 @@ class FrameLoader {
                                 settings.getAllowFileAccess())).sendToTarget();
             }
             return true;
-        } else if (URLUtil.isContentUrl(url)) {
+        } else if (settings.getAllowContentAccess() &&
+                   URLUtil.isContentUrl(url)) {
             // Send the raw url to the ContentLoader because it will do a
             // permission check and the url has to match.
             if (loadListener.isSynchronous()) {
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java
index 67504223c722e..0670c4e620e0f 100644
--- a/core/java/android/webkit/WebSettings.java
+++ b/core/java/android/webkit/WebSettings.java
@@ -215,6 +215,7 @@ public class WebSettings {
     private boolean         mBuiltInZoomControls = false;
     private boolean         mDisplayZoomControls = true;
     private boolean         mAllowFileAccess = true;
+    private boolean         mAllowContentAccess = true;
     private boolean         mLoadWithOverviewMode = false;
     private boolean         mEnableSmoothTransition = false;
 
@@ -587,7 +588,9 @@ public class WebSettings {
 
     /**
      * Enable or disable file access within WebView. File access is enabled by
-     * default.
+     * default.  Note that this enables or disables file system access only.
+     * Assets and resources are still accessible using file:///android_asset and
+     * file:///android_res.
      */
     public void setAllowFileAccess(boolean allow) {
         mAllowFileAccess = allow;
@@ -600,6 +603,22 @@ public class WebSettings {
         return mAllowFileAccess;
     }
 
+    /**
+     * Enable or disable content url access within WebView.  Content url access
+     * allows WebView to load content from a content provider installed in the
+     * system.  The default is enabled.
+     */
+    public void setAllowContentAccess(boolean allow) {
+        mAllowContentAccess = allow;
+    }
+
+    /**
+     * Returns true if this WebView supports content url access.
+     */
+    public boolean getAllowContentAccess() {
+        return mAllowContentAccess;
+    }
+
     /**
      * Set whether the WebView loads a page with overview mode.
      */