search

qzindustries / qz-print

Free browser applet for sending documents and raw commands to a printer.
Other
49 stars 4 forks source link

appendFile() only allows same-domain URLs #28

Closed tresf closed 9 years ago

tresf commented 10 years ago

2.0.0 branch only.

Offending code is here: https://github.com/qzindustries/qz-print/blob/master/qz-print/src/qz/PrintApplet.java#L381

PrintApplet should never directly call something outside of the sandbox. This function needs to be invoked as a privileged function, preferably asynchronous and queued.

tresf commented 9 years ago

Closing, this bug exists solely on a non-maintained branch (master). https://github.com/qzind/qz-print has the latest (1.9 at the time of writing this).