From 49607e1313951ad1eb35615cf76ea043c4bee0d5 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Mon, 23 Jan 2017 08:32:30 +0100
Subject: [PATCH] portalHelper: Don't change the main window title

The title of the window should not be in control of a potentially
hostile hotspot provider, so only set the subtitle to be that of the
page, the main title will stay the same.

The subtitle will also be set to a URI, so that the hotspot cannot be
used to control the title shown in our UI.

Helps https://bugzilla.gnome.org/show_bug.cgi?id=749197
---
 js/portalHelper/main.js | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/js/portalHelper/main.js b/js/portalHelper/main.js
index c7d0433a9..94e7a8dfd 100644
--- a/js/portalHelper/main.js
+++ b/js/portalHelper/main.js
@@ -51,7 +51,13 @@ const PortalWindow = new Lang.Class({
 
     _init: function(application, url, timestamp, doneCallback) {
         this.parent({ application: application });
+
         this.connect('delete-event', Lang.bind(this, this.destroyWindow));
+        /* TRANSLATORS: this is the title of the wifi captive portal login window */
+        this._headerBar = new Gtk.HeaderBar({ title: _("Hotspot Login"),
+                                              show_close_button: true });
+        this.set_titlebar(this._headerBar);
+        this._headerBar.show();
 
         if (!url) {
             url = CONNECTIVITY_CHECK_URI;
@@ -76,8 +82,8 @@ const PortalWindow = new Lang.Class({
         this._webView = WebKit.WebView.new_with_context(webContext);
         this._webView.connect('decide-policy', Lang.bind(this, this._onDecidePolicy));
         this._webView.load_uri(url);
-        this._webView.connect('notify::title', Lang.bind(this, this._syncTitle));
-        this._syncTitle();
+        this._webView.connect('notify::uri', Lang.bind(this, this._syncUri));
+        this._syncUri();
 
         this.add(this._webView);
         this._webView.show();
@@ -93,16 +99,12 @@ const PortalWindow = new Lang.Class({
         FileUtils.recursivelyDeleteDir(this._cacheDir, true);
     },
 
-    _syncTitle: function() {
-        let title = this._webView.title;
-
-        if (title) {
-            this.title = title;
-        } else {
-            /* TRANSLATORS: this is the title of the wifi captive portal login
-             * window, until we know the title of the actual login page */
-            this.title = _("Web Authentication Redirect");
-        }
+    _syncUri: function() {
+        let uri = this._webView.uri;
+        if (uri)
+            this._headerBar.set_subtitle(GLib.uri_unescape_string(uri, null, false));
+        else
+            this._headerBar.set_subtitle(null);
     },
 
     refresh: function() {