comparison src/gtknotify.c @ 9520:cb7f26f30d02

[gaim-migrate @ 10347] "I can put you in Queens on the night of the robbery." "Really? I live in Queens. You got a crack team of monkeys working around the clock back there?" Thanks to Daniel Atallah for fixing this and to Nathan Walp for pointing it out. committer: Tailor Script <[e-mail]>

9519:8cd47267c5bd

		uri_command(command, FALSE);

	g_free(command);

#else /* !_WIN32 */
	ShellExecute(NULL, NULL, uri, NULL, ".\\", 0);
#endif /* !_WIN32 */

	return NULL;
}

9520:cb7f26f30d02

		uri_command(command, FALSE);

	g_free(command);

#else /* !_WIN32 */
	/**
	 * Since this could be potentially dangerous,
	 * allowing a URI to try to perform some sort of malicious operation,
	 * we only allow execution when the URI starts with
	 * "http://", "https://", "ftp://", "mailto:"
	 */
	if (g_ascii_strncasecmp(uri, "http://", 7) == 0
			|| g_ascii_strncasecmp(uri, "mailto:", 7) == 0
			|| g_ascii_strncasecmp(uri, "https://", 8) == 0
			|| g_ascii_strncasecmp(uri, "ftp://", 6) == 0
		) {
		ShellExecute(NULL, NULL, uri, NULL, ".\\", 0);
	} else {
		gaim_debug_misc("gtknotify", "Ignoring '%s' URI as it is not recognized as a secure URI.\n", uri);
	}
#endif /* !_WIN32 */

	return NULL;
}