diff --git a/NOTICE b/NOTICE index 4d37500..8ec56a5 100644 --- a/NOTICE +++ b/NOTICE @@ -1 +1,5 @@ -Icons used in ths plugin are reproduced from work created and shared by the Android Open Source Project and used according to terms described in the Creative Commons 2.5 Attribution License. +Apache Cordova +Copyright 2012 The Apache Software Foundation + +This product includes software developed at +The Apache Software Foundation (http://www.apache.org/). diff --git a/RELEASENOTES.md b/RELEASENOTES.md index 2b95181..293e125 100644 --- a/RELEASENOTES.md +++ b/RELEASENOTES.md @@ -73,3 +73,8 @@ * CB-5756: Android: Use WebView.evaluateJavascript for script injection on Android 4.4+ * Remove alive from InAppBrowser.js since it didn't catch the case where the browser is closed by the user. * CB-5733 Fix IAB.close() not working if called before show() animation is done + +### 0.3.2 (Feb 26, 2014) +* Validate that callbackId is correctly formed +* CB-6035 Move js-module so it is not loaded on unsupported platforms +* Removed some iOS6 Deprecations diff --git a/plugin.xml b/plugin.xml index 0878073..77adc5c 100644 --- a/plugin.xml +++ b/plugin.xml @@ -2,7 +2,7 @@ + version="0.3.2"> InAppBrowser Cordova InAppBrowser Plugin @@ -14,13 +14,12 @@ - - - - - + + + + @@ -50,6 +49,9 @@ + + + @@ -62,6 +64,9 @@ + + + @@ -69,7 +74,10 @@ - + + + + @@ -82,15 +90,11 @@ - - + + + @@ -102,6 +106,9 @@ + + + @@ -113,6 +120,9 @@ + + + diff --git a/src/ios/CDVInAppBrowser.h b/src/ios/CDVInAppBrowser.h index 581bcd0..8e2ab12 100644 --- a/src/ios/CDVInAppBrowser.h +++ b/src/ios/CDVInAppBrowser.h @@ -30,6 +30,7 @@ @property (nonatomic, retain) CDVInAppBrowserViewController* inAppBrowserViewController; @property (nonatomic, copy) NSString* callbackId; +@property (nonatomic, copy) NSRegularExpression *callbackIdPattern; - (void)open:(CDVInvokedUrlCommand*)command; - (void)close:(CDVInvokedUrlCommand*)command; diff --git a/src/ios/CDVInAppBrowser.m b/src/ios/CDVInAppBrowser.m index a660ac2..88b737c 100644 --- a/src/ios/CDVInAppBrowser.m +++ b/src/ios/CDVInAppBrowser.m @@ -47,6 +47,7 @@ self = [super initWithWebView:theWebView]; if (self != nil) { _previousStatusBarStyle = -1; + _callbackIdPattern = nil; } return self; @@ -297,6 +298,23 @@ [self injectDeferredObject:[command argumentAtIndex:0] withWrapper:jsWrapper]; } +- (BOOL)isValidCallbackId:(NSString *)callbackId +{ + NSError *err = nil; + // Initialize on first use + if (self.callbackIdPattern == nil) { + self.callbackIdPattern = [NSRegularExpression regularExpressionWithPattern:@"^InAppBrowser[0-9]{1,10}$" options:0 error:&err]; + if (err != nil) { + // Couldn't initialize Regex; No is safer than Yes. + return NO; + } + } + if ([self.callbackIdPattern firstMatchInString:callbackId options:0 range:NSMakeRange(0, [callbackId length])]) { + return YES; + } + return NO; +} + /** * The iframe bridge provided for the InAppBrowser is capable of executing any oustanding callback belonging * to the InAppBrowser plugin. Care has been taken that other callbacks cannot be triggered, and that no @@ -323,7 +341,7 @@ NSString* scriptCallbackId = [url host]; CDVPluginResult* pluginResult = nil; - if ([scriptCallbackId hasPrefix:@"InAppBrowser"]) { + if ([self isValidCallbackId:scriptCallbackId]) { NSString* scriptResult = [url path]; NSError* __autoreleasing error = nil; @@ -510,14 +528,14 @@ self.addressLabel.contentStretch = CGRectFromString(@"{{0, 0}, {1, 1}}"); self.addressLabel.enabled = YES; self.addressLabel.hidden = NO; - self.addressLabel.lineBreakMode = UILineBreakModeTailTruncation; - self.addressLabel.minimumFontSize = 10.000; + self.addressLabel.lineBreakMode = NSLineBreakByTruncatingTail; + self.addressLabel.minimumScaleFactor = 10.000; self.addressLabel.multipleTouchEnabled = NO; self.addressLabel.numberOfLines = 1; self.addressLabel.opaque = NO; self.addressLabel.shadowOffset = CGSizeMake(0.0, -1.0); self.addressLabel.text = NSLocalizedString(@"Loading...", nil); - self.addressLabel.textAlignment = UITextAlignmentLeft; + self.addressLabel.textAlignment = NSTextAlignmentLeft; self.addressLabel.textColor = [UIColor colorWithWhite:1.000 alpha:1.000]; self.addressLabel.userInteractionEnabled = NO;