New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable node in webviews when disabled in parent window #5244

Merged
merged 2 commits into from Apr 22, 2016

Conversation

Projects
None yet
4 participants
@kevinsawicki
Contributor

kevinsawicki commented Apr 21, 2016

This pull request always disabled node integration on <webview> if it is disabled on the parent BrowserWindow.

Previously node integration on a <webview> could be enabled even when the parent did not have it.

This is a follow on to #4897 which disabled node integration on windows opened via window.open when it was disabled on the parent window.

Now nodeIntegration inheritance will behave consistently across <webview> tags and window.open windows.

Refs #3943

/cc @zcbenz @laramies

@kevinsawicki kevinsawicki changed the title from Disable node on web view when disabled on parent window to Disable node on webviews when disabled on parent window Apr 21, 2016

@kevinsawicki kevinsawicki changed the title from Disable node on webviews when disabled on parent window to Disable node in webviews when disabled in parent window Apr 21, 2016

@paulcbetts

This comment has been minimized.

Contributor

paulcbetts commented Apr 21, 2016

👍

@zcbenz

This comment has been minimized.

Contributor

zcbenz commented Apr 22, 2016

This looks good to me.

Fixes #3943

I would like to keep #3943 open since the ultimate goal is to disable webview completely when there is no node integration. Otherwise there would still be lots of security problems.

@laramies

This comment has been minimized.

laramies commented Apr 22, 2016

Great, thanks!

@kevinsawicki

This comment has been minimized.

Contributor

kevinsawicki commented Apr 22, 2016

I would like to keep #3943 open since the ultimate goal is to disable webview completely when there is no node integration.

Sounds good 👍

@kevinsawicki kevinsawicki merged commit 08e18d4 into master Apr 22, 2016

8 of 9 checks passed

continuous-integration/travis-ci/push The Travis CI build could not complete due to an error
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
electron-linux-arm Build #3107665 succeeded in 82s
Details
electron-linux-ia32 Build #3107666 succeeded in 81s
Details
electron-linux-x64 Build #3107667 succeeded in 107s
Details
electron-mas-x64 Build #927 succeeded in 4 min 55 sec
Details
electron-osx-x64 Build #944 succeeded in 5 min 24 sec
Details
electron-win-ia32 Build #3107668 succeeded in 160s
Details
electron-win-x64 Build #3107669 succeeded in 162s
Details

@kevinsawicki kevinsawicki deleted the disable-node-in-web-view-when-disabled-in-parent branch Apr 22, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment