From 9671f123b7cda20365173fcc65c11f0a8334abb7 Mon Sep 17 00:00:00 2001
From: "martijn.martijn%gmail.com" <martijn.martijn%gmail.com>
Date: Mon, 3 Apr 2006 18:12:37 +0000
Subject: [PATCH] Bug 197305 - setting designMode on data: URLs throws security
 exception, r=bzbarsky, sr=dveditz

---
 content/html/document/src/nsHTMLDocument.cpp | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index d5339dd8ff7..13724ffdd8a 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -3603,17 +3603,18 @@ nsHTMLDocument::SetDesignMode(const nsAString & aDesignMode)
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
-  nsCAutoString url;
-  mDocumentURI->GetSpec(url);
   // test if the above works if document.domain is set for Midas document
   // (www.netscape.com --> netscape.com)
-  if (!url.Equals("about:blank")) {
-    // If we're 'about:blank' then we don't care who can edit us.
-    // If we're not about:blank, then we need to check sameOrigin.
-    rv = nsContentUtils::GetSecurityManager()->CheckSameOrigin(nsnull,
-                                                            mDocumentURI);
-    if (NS_FAILED(rv))
-      return rv;
+  nsIPrincipal *principal = GetNodePrincipal();
+  if (!principal)
+    return NS_ERROR_FAILURE;
+  nsCOMPtr<nsIPrincipal> subject;
+  nsIScriptSecurityManager *secMan = nsContentUtils::GetSecurityManager();
+  rv = secMan->GetSubjectPrincipal(getter_AddRefs(subject));
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (subject) {
+     rv = secMan->CheckSameOriginPrincipal(subject, principal);
+     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   nsCOMPtr<nsIEditingSession> editSession = do_GetInterface(docshell);