From ca2645b7078cb269e6982cbb14a021241a23592b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Tue, 1 Sep 2026 14:35:44 +0000 Subject: [PATCH] dbaccess: use the same script checks as an office document MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit a database document isn't an SfxObjectShell, so its bound event scripts run from DocumentEventExecutor rather than from SfxEvents_Impl::Execute Change-Id: I72cd173b95301c66c2c10932261bbccbf620c46b Signed-off-by: Caolán McNamara Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/11742 Tested-by: Jenkins CPCI Reviewed-by: Andras Timar (cherry picked from commit 635a4c0f95b51c108c1ecb723a99fc250a187d61) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211802 Tested-by: Jenkins Reviewed-by: Xisco Fauli --- .../source/core/dataaccess/documenteventexecutor.cxx | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dbaccess/source/core/dataaccess/documenteventexecutor.cxx b/dbaccess/source/core/dataaccess/documenteventexecutor.cxx index aebaf385e64b..2ce40b75a3f0 100644 --- a/dbaccess/source/core/dataaccess/documenteventexecutor.cxx +++ b/dbaccess/source/core/dataaccess/documenteventexecutor.cxx @@ -27,8 +27,10 @@ #include #include +#include #include #include +#include #include namespace dbaccess @@ -166,6 +168,16 @@ namespace dbaccess if ( bDispatchScriptURL && bNonEmptyScript ) { + // the same three tests an office document takes before a bound script runs + if ( !SfxObjectShell::isScriptURLAllowed( sScript ) ) + return; + + if ( !SfxObjectShell::isScriptAccessAllowed( cppu::getXWeak( xDocument.get() ) ) ) + return; + + if ( SfxObjectShell::UnTrustedScript( sScript ) ) + return; + lcl_dispatchScriptURL_throw( mxDocument, mxURLTransformer, sScript, Event ); } }