Index: Source/core/fetch/CrossOriginAccessControl.cpp |
diff --git a/Source/core/fetch/CrossOriginAccessControl.cpp b/Source/core/fetch/CrossOriginAccessControl.cpp |
index 5efd898b70132d80c4e7f613293176f682a75d2a..e890a65e0041180f0973d0b7645d7f54ad6d06ca 100644 |
--- a/Source/core/fetch/CrossOriginAccessControl.cpp |
+++ b/Source/core/fetch/CrossOriginAccessControl.cpp |
@@ -216,13 +216,13 @@ bool CrossOriginAccessControl::isLegalRedirectLocation(const KURL& requestURL, S |
return true; |
} |
-bool CrossOriginAccessControl::handleRedirect(SecurityOrigin* securityOrigin, ResourceRequest& request, const ResourceResponse& redirectResponse, StoredCredentials withCredentials, ResourceLoaderOptions& options, String& errorMessage) |
+bool CrossOriginAccessControl::handleRedirect(SecurityOrigin* securityOrigin, ResourceRequest& newRequest, const ResourceResponse& redirectResponse, StoredCredentials withCredentials, ResourceLoaderOptions& options, String& errorMessage) |
{ |
// http://www.w3.org/TR/cors/#redirect-steps terminology: |
const KURL& originalURL = redirectResponse.url(); |
- const KURL& requestURL = request.url(); |
+ const KURL& newURL = newRequest.url(); |
- bool redirectCrossOrigin = !securityOrigin->canRequest(requestURL); |
+ bool redirectCrossOrigin = !securityOrigin->canRequest(newURL); |
// Same-origin request URLs that redirect are allowed without checking access. |
if (!securityOrigin->canRequest(originalURL)) { |
@@ -230,7 +230,7 @@ bool CrossOriginAccessControl::handleRedirect(SecurityOrigin* securityOrigin, Re |
String errorDescription; |
// Steps 3 & 4 - check if scheme and other URL restrictions hold. |
- bool allowRedirect = isLegalRedirectLocation(requestURL, errorDescription); |
+ bool allowRedirect = isLegalRedirectLocation(newURL, errorDescription); |
if (allowRedirect) { |
// Step 5: perform resource sharing access check. |
allowRedirect = passesAccessControlCheck(redirectResponse, withCredentials, securityOrigin, errorDescription); |
@@ -238,7 +238,7 @@ bool CrossOriginAccessControl::handleRedirect(SecurityOrigin* securityOrigin, Re |
RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(originalURL); |
// Step 6: if the request URL origin is not same origin as the original URL's, |
// set the source origin to a globally unique identifier. |
- if (!originalOrigin->canRequest(requestURL)) { |
+ if (!originalOrigin->canRequest(newURL)) { |
options.securityOrigin = SecurityOrigin::createUnique(); |
securityOrigin = options.securityOrigin.get(); |
} |
@@ -252,8 +252,8 @@ bool CrossOriginAccessControl::handleRedirect(SecurityOrigin* securityOrigin, Re |
} |
if (redirectCrossOrigin) { |
// If now to a different origin, update/set Origin:. |
- request.clearHTTPOrigin(); |
- request.setHTTPOrigin(securityOrigin->toAtomicString()); |
+ newRequest.clearHTTPOrigin(); |
+ newRequest.setHTTPOrigin(securityOrigin->toAtomicString()); |
// If the user didn't request credentials in the first place, update our |
// state so we neither request them nor expect they must be allowed. |
if (options.credentialsRequested == ClientDidNotRequestCredentials) |