hixie: Fix a potential security problem with the use of progress events. (whatwg r3764)

hixie: Fix a potential security problem with the use of progress events.
(whatwg r3764)

http://dev.w3.org/cvsweb/html5/spec/Overview.html?r1=1.2933&r2=1.2934&f=h
http://html5.org/tools/web-apps-tracker?from=3763&to=3764

===================================================================
RCS file: /sources/public/html5/spec/Overview.html,v
retrieving revision 1.2933
retrieving revision 1.2934
diff -u -d -r1.2933 -r1.2934
--- Overview.html 4 Sep 2009 23:37:39 -0000 1.2933
+++ Overview.html 7 Sep 2009 10:00:36 -0000 1.2934
@@ -174,7 +174,7 @@
    <h2 class="no-num no-toc" id="a-vocabulary-and-associated-apis-for-html-and-xhtml">A vocabulary and associated APIs for HTML and XHTML</h2>
    <!--ZZZ:-->
    <h2 class="no-num no-toc" id="w3c-working-draft-25-august-2009">W3C Working Draft 25 August 2009</h2>
-   <!--<h2 class="no-num no-toc">Editor's Draft 4 September 2009</h2>-->
+   <!--<h2 class="no-num no-toc">Editor's Draft 7 September 2009</h2>-->
    <!--:ZZZ-->
    <dl><!-- ZZZ: update the month/day (twice), (un)comment out--><dt>This Version:</dt>
     <dd><a href="http://www.w3.org/TR/2009/WD-html5-20090825/">http://www.w3.org/TR/2009/WD-html5-20090825/</a></dd>
@@ -272,7 +272,7 @@
   track.
   <!--ZZZ:-->
   This specification is the 25 August 2009 Working Draft.
-  <!--This specification is the 4 September 2009 Editor's Draft.-->
+  <!--This specification is the 7 September 2009 Editor's Draft.-->
   <!--:ZZZ-->
   </p><!-- UNDER NO CIRCUMSTANCES IS THE PRECEDING PARAGRAPH TO BE REMOVED OR EDITED WITHOUT TALKING TO IAN FIRST --><!-- relationship to other work (required) --><p>This specification is also being produced by the <a href="http://www.whatwg.org/">WHATWG</a>. The two specifications are
   identical from the table of contents onwards.</p><!-- UNDER NO CIRCUMSTANCES IS THE FOLLOWING PARAGRAPH TO BE REMOVED OR EDITED WITHOUT TALKING TO IAN FIRST --><!-- UNDER NO CIRCUMSTANCES IS THE PRECEDING PARAGRAPH TO BE REMOVED OR EDITED WITHOUT TALKING TO IAN FIRST --><!-- context and rationale (required) --><p>This specification is intended to replace (be a new version of)
@@ -44132,7 +44132,10 @@
   algorithm</a>, means that an event with the name <var title="">e</var>, with no namespace, which does not bubble (unless
   otherwise stated) and is not cancelable (unless otherwise stated),
   and which uses the <code>ProgressEvent</code> interface, must be
-  dispatched at the given target. If there is a <a href="#fetch" title="fetch">fetching algorithm</a>, then the <code title="dom-ProgressEvents-lengthComputable">lengthComputable</code>
+  dispatched at the given target element. If there is a <a href="#fetch" title="fetch">fetching algorithm</a>, and the <a href="#url">URL</a>
+  being <a href="#fetch" title="fetch">fetched</a> has the <a href="#same-origin">same
+  origin</a> as the <code>Document</code> of the target element,
+  then the <code title="dom-ProgressEvents-lengthComputable">lengthComputable</code>
   attribute must be set to true if the <a href="#fetch" title="fetch">fetching
   algorithm</a>'s subject has a known <a href="#concept-fetch-total" title="concept-fetch-total">size</a>; the <code title="dom-ProgressEvents-total">total</code> attribute must be set
   to the subject's <a href="#concept-fetch-total" title="concept-fetch-total">size</a> if it

Received on Monday, 7 September 2009 10:17:10 UTC