Merge pull request #31 from blackberry-webworks/next-whitelist

Fix for whitelist issue
blackberry-webworks · Dec 12, 2011 · 7fc7c7d · 7fc7c7d
2 parents 14e9b8c + 1dd9e83
commit 7fc7c7d
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/framework/src/blackberry/web/widget/policy/WidgetPolicy.java b/framework/src/blackberry/web/widget/policy/WidgetPolicy.java
@@ -80,10 +80,13 @@ public WidgetAccess getElement( String request, WidgetAccess[] accessList ) {
                 if ( schemeString.equals( "local" ) && folderAccess == null ) {
                     return _localAccess;
                 }
-
+                
                 if(folderAccess != null) {
                     fetchedAccess = folderAccess.getWidgetAccess( requestURI.getPath() + parseNull( requestURI.getQuery() ) );
                 }
+                if( !isMatch( fetchedAccess, requestURI ) ) {
+                    fetchedAccess = folderAccess.getWidgetAccess( requestURI.getPath() + "*" );
+                }
 
                 boolean failedToFindAccess = false;
                 // Make sure we've got the right one
@@ -126,6 +129,10 @@ public WidgetAccess getElement( String request, WidgetAccess[] accessList ) {
     }
 
     private boolean isMatch( WidgetAccess access, URI toMatchURI ) {
+        if( access == null ) {
+            return false;
+        }
+
         // Look for local first
         if( WidgetUtil.isLocalURI( toMatchURI ) && access.isLocal() ) {
             // local access always allowed
@@ -172,6 +179,9 @@ else if( WidgetUtil.isDataURI( toMatchURI ) ) {
         // 5. Compare path+query
         String refPath = referenceURI.getPath() + parseNull( referenceURI.getQuery() );
         String toMatchPath = toMatchURI.getPath() + parseNull( toMatchURI.getQuery() );
+        if( refPath.endsWith( "*" ) ) {
+            refPath = refPath.substring( 0, refPath.length() - 1 );
+        }
         if( !toMatchPath.startsWith( refPath ) ) {
             return false;
         }