Fix file event.originalTarget problem (bug 163598), r=joki@netscape.com, sr=jst@netscape.com

content/events/public/nsIPrivateDOMEvent.h

@@ -69,6 +69,8 @@ public:
   NS_IMETHOD HasOriginalTarget(PRBool* aResult)=0;
   NS_IMETHOD IsTrustedEvent(PRBool* aResult)=0;
   NS_IMETHOD SetTrusted(PRBool aTrusted)=0;
+  
+  NS_IMETHOD GetOriginalTargetTrusted(nsIDOMEventTarget** aTarget) = 0;
 };
 
 extern nsresult NS_NewDOMEvent(nsIDOMEvent** aInstancePtrResult, nsIPresContext* aPresContext, nsEvent *aEvent);

content/events/src/nsDOMEvent.cpp

@@ -62,6 +62,7 @@
 #include "nsContentUtils.h"
 #include "nsIDOMKeyEvent.h"
 #include "nsIDOMMutationEvent.h"
+#include "nsIFormControl.h"
 
 static const char* const mEventNames[] = {
   "mousedown", "mouseup", "click", "dblclick", "mouseover",
@@ -197,6 +198,7 @@ nsDOMEvent::nsDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent,
   mTarget = nsnull;
   mCurrentTarget = nsnull;
   mOriginalTarget = nsnull;
+  mRealOriginalTarget = nsnull;
   mText = nsnull;
   mTextRange = nsnull;
   mButton = -1;
@@ -267,6 +269,7 @@ nsDOMEvent::~nsDOMEvent()
   NS_IF_RELEASE(mTarget);
   NS_IF_RELEASE(mCurrentTarget);
   NS_IF_RELEASE(mOriginalTarget);
+  NS_IF_RELEASE(mRealOriginalTarget);
   NS_IF_RELEASE(mTextRange);
 
   if (mEventIsInternal) {
@@ -375,6 +378,23 @@ nsDOMEvent::GetOriginalTarget(nsIDOMEventTarget** aOriginalTarget)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDOMEvent::GetOriginalTargetTrusted(nsIDOMEventTarget** aOriginalTarget)
+{
+  if (mRealOriginalTarget) {
+    *aOriginalTarget = mRealOriginalTarget;
+    NS_ADDREF(*aOriginalTarget);
+    return NS_OK;
+  }
+
+  if (!mOriginalTarget)
+    return GetTarget(aOriginalTarget);
+
+  *aOriginalTarget = mOriginalTarget;
+  NS_ADDREF(*aOriginalTarget);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMEvent::HasOriginalTarget(PRBool* aResult)
 {
@@ -1345,6 +1365,46 @@ NS_METHOD nsDOMEvent::SetCurrentTarget(nsIDOMEventTarget* aCurrentTarget)
 NS_METHOD nsDOMEvent::SetOriginalTarget(nsIDOMEventTarget* aOriginalTarget)
 {
   if (mOriginalTarget != aOriginalTarget) {
+    // Fix for bug 163598.  Do not expose anonymous content via originalTarget for
+    // file upload controls.  To accomplish this we look to see if the
+    // originalTarget is inside a file upload control.
+    nsCOMPtr<nsIContent> content(do_QueryInterface(aOriginalTarget));
+    if (content) {
+      PRUint32 numParentsChecked = 0;
+      nsCOMPtr<nsIContent> parent;
+      content->GetParent(*getter_AddRefs(parent));
+      while (parent) {
+        numParentsChecked++;
+        // Only matters if we're an HTML form control.  |originalTarget| is
+        // defined all over the place for XUL, so this saves XUL (and non-form
+        // controls) from paying the cost of a failed QI.
+        if (parent->IsContentOfType(nsIContent::eHTML_FORM_CONTROL)) {
+          nsCOMPtr<nsIFormControl> inputControl(do_QueryInterface(parent));
+          if (inputControl) {
+            PRInt32 type;
+            inputControl->GetType(&type); 
+            if (type == NS_FORM_INPUT_FILE) {
+              NS_IF_RELEASE(mOriginalTarget);
+              mOriginalTarget = nsnull;
+              mRealOriginalTarget = aOriginalTarget;
+              NS_IF_ADDREF(mRealOriginalTarget);
+              return NS_OK;
+            }
+          }
+        }
+
+        // We're looking for input type=file, and anonymous content doesn't go any
+        // deeper than 3 deep under input type=file (input type=text, div,
+        // textnode)
+        if (numParentsChecked >= 3) {
+          break;
+        }
+
+        content = parent;
+        content->GetParent(*getter_AddRefs(parent));
+      }
+    }
+
     NS_IF_RELEASE(mOriginalTarget);
     NS_IF_ADDREF(aOriginalTarget);
     mOriginalTarget = aOriginalTarget;

content/events/src/nsDOMEvent.h

@@ -180,6 +180,7 @@ public:
   NS_IMETHOD    SetTarget(nsIDOMEventTarget* aTarget);
   NS_IMETHOD    SetCurrentTarget(nsIDOMEventTarget* aCurrentTarget);
   NS_IMETHOD    SetOriginalTarget(nsIDOMEventTarget* aOriginalTarget);
+  NS_IMETHOD    GetOriginalTargetTrusted(nsIDOMEventTarget** aOriginalTarget);
   NS_IMETHOD    IsDispatchStopped(PRBool* aIsDispatchStopped);
   NS_IMETHOD    GetInternalNSEvent(nsEvent** aNSEvent);
   NS_IMETHOD    HasOriginalTarget(PRBool* aResult);
@@ -232,6 +233,7 @@ protected:
   nsIDOMEventTarget* mTarget;
   nsIDOMEventTarget* mCurrentTarget;
   nsIDOMEventTarget* mOriginalTarget;
+  nsIDOMEventTarget* mRealOriginalTarget;
   nsString*	mText;
   nsIPrivateTextRangeList*	mTextRange;
   PRPackedBool mEventIsInternal;

content/html/content/src/nsHTMLInputElement.cpp

@@ -1356,13 +1356,8 @@ nsHTMLInputElement::HandleDOMEvent(nsIPresContext* aPresContext,
       (*aDOMEvent)->GetTarget(getter_AddRefs(oldTarget));
 
       nsCOMPtr<nsIDOMEventTarget> originalTarget;
-
-      nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(*aDOMEvent));
-
-      if (nsevent) {
-        nsevent->GetOriginalTarget(getter_AddRefs(originalTarget));
-      }
-
+      privateEvent->GetOriginalTargetTrusted(getter_AddRefs(originalTarget));
+      
       if (!originalTarget) {
         privateEvent->SetOriginalTarget(oldTarget);
       }

dom/src/base/nsFocusController.cpp

@@ -29,7 +29,7 @@
 #include "nsIDOMNSHTMLInputElement.h"
 #include "nsIDOMNSHTMLTextAreaElement.h"
 #include "nsIDOMUIEvent.h"
-#include "nsIDOMNSEvent.h"
+#include "nsIPrivateDOMEvent.h"
 #include "nsIDOMWindowInternal.h"
 #include "nsIDocument.h"
 #include "nsIPresContext.h"
@@ -260,10 +260,9 @@ nsFocusController::Focus(nsIDOMEvent* aEvent)
 
   nsCOMPtr<nsIDOMEventTarget> t;
 
-  nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aEvent));
-  if (nsevent) {
-    nsevent->GetOriginalTarget(getter_AddRefs(t));
-  }
+  nsCOMPtr<nsIPrivateDOMEvent> privateEvent(do_QueryInterface(aEvent));
+  if (privateEvent)
+    privateEvent->GetOriginalTargetTrusted(getter_AddRefs(t));
 
   nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(t);
   if (domElement && (domElement != mCurrentElement)) {
@@ -316,11 +315,10 @@ nsFocusController::Blur(nsIDOMEvent* aEvent)
 
   nsCOMPtr<nsIDOMEventTarget> t;
 
-  nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aEvent));
+  nsCOMPtr<nsIPrivateDOMEvent> privateEvent(do_QueryInterface(aEvent));
 
-  if (nsevent) {
-    nsevent->GetOriginalTarget(getter_AddRefs(t));
-  }
+  if (privateEvent)
+    privateEvent->GetOriginalTargetTrusted(getter_AddRefs(t));
 
   nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(t);
   if (domElement) {