dbaccess: use the same script checks as an office document

a database document isn't an SfxObjectShell, so its bound event
scripts run from DocumentEventExecutor rather than from
SfxEvents_Impl::Execute

Change-Id: I72cd173b95301c66c2c10932261bbccbf620c46b
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/11742
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Andras Timar <andras.timar@collabora.com>
(cherry picked from commit 635a4c0f95b51c108c1ecb723a99fc250a187d61)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211802
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>

dbaccess/source/core/dataaccess/documenteventexecutor.cxx

@@ -27,8 +27,10 @@
 #include <com/sun/star/frame/XDispatchProvider.hpp>
 
 #include <comphelper/namedvaluecollection.hxx>
+#include <cppuhelper/weak.hxx>
 #include <cppuhelper/weakref.hxx>
 #include <comphelper/diagnose_ex.hxx>
+#include <sfx2/objsh.hxx>
 #include <vcl/svapp.hxx>
 
 namespace dbaccess
@@ -166,6 +168,16 @@ namespace dbaccess
 
             if ( bDispatchScriptURL && bNonEmptyScript )
             {
+                // the same three tests an office document takes before a bound script runs
+                if ( !SfxObjectShell::isScriptURLAllowed( sScript ) )
+                    return;
+
+                if ( !SfxObjectShell::isScriptAccessAllowed( cppu::getXWeak( xDocument.get() ) ) )
+                    return;
+
+                if ( SfxObjectShell::UnTrustedScript( sScript ) )
+                    return;
+
                 lcl_dispatchScriptURL_throw( mxDocument, mxURLTransformer, sScript, Event );
             }
         }