lee/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter.git synced 2026-08-27 08:27:43 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Restrict the permission popup flow to third-party websites

Browse Source 
requestPermission's new web path ran in every environment with a window,
including env='gui' — so a permission_denied driver retry inside the
Puter GUI would open a popup to the Puter origin from the desktop itself
and try to grant the permission to a phantom app for Puter's own origin.
Resolve false everywhere except env='web', the previous behavior.
This commit is contained in:
jelveh
2026-07-25 21:02:45 -07:00
parent 08356b4ea9
commit bdc11ffcf8
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/puter-js/src/modules/UI.js
+9 -2
View File
@@ -1119,8 +1119,15 @@ class UI extends EventListener {
return result.granted === true;
}
// Web environment: open the GUI's permission popup. Not available in
// workers (no window to open a popup from).
// The popup flow is for third-party websites only. In every other
// environment it either can't work (workers and node have no window
// to open a popup from) or makes no sense — inside the Puter GUI
// itself ('gui') the popup would prompt the user to grant this
// permission to Puter's own origin. Those callers keep the previous
// behavior of resolving false.
if ( this.env !== 'web' ) {
return false;
}
if ( ! globalThis.open || ! globalThis.document ) {
return false;
}