Flash: Restrict scripting abillity to swf's own domain only.

moxiecode · Apr 10, 2012 · 1fc3a50 · 1fc3a50
1 parent e020363
commit 1fc3a50
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/src/flash/plupload/src/com/plupload/Plupload.as b/src/flash/plupload/src/com/plupload/Plupload.as
@@ -73,8 +73,8 @@ package com.plupload {
 		private function init(e:Event = null):void {
 			removeEventListener(Event.ADDED_TO_STAGE, init);
 
-			// Allow upload cross domain upload
-			Security.allowDomain("*");
+			// Allow upload cross domain access
+			// Security.allowDomain("*");
 
 			// Setup id
 			this.id = this.stage.loaderInfo.parameters["id"];

diff --git a/src/javascript/plupload.flash.js b/src/javascript/plupload.flash.js
@@ -191,10 +191,15 @@
 			});
 
 			// Wait for Flash to send init event
-			uploader.bind("Flash:Init", function() {	
+			uploader.bind("Flash:Init", function() {				
 				var lookup = {}, i;
 
-				getFlashObj().setFileFilters(uploader.settings.filters, uploader.settings.multi_selection);
+				try {
+					getFlashObj().setFileFilters(uploader.settings.filters, uploader.settings.multi_selection);
+				} catch (ex) {
+					callback({success : false});
+					return;
+				}
 
 				// Prevent eventual reinitialization of the instance
 				if (initialized[uploader.id]) {