[geary/bug/728002-webkit2: 140/140] Explicitly allow loading only geary:body in ClientWebView.

[Michael Gratton <mjog src gnome org>]

commit e8aa38f6695687607c4adfbe1f4fb856a78d6db6
Author: Michael James Gratton <mike vee net>
Date:   Tue Jan 31 23:58:08 2017 +1100

    Explicitly allow loading only geary:body in ClientWebView.

 src/client/components/client-web-view.vala |   15 +++++++++++----
 1 files changed, 11 insertions(+), 4 deletions(-)
---
diff --git a/src/client/components/client-web-view.vala b/src/client/components/client-web-view.vala
index c425a9b..df05982 100644
--- a/src/client/components/client-web-view.vala
+++ b/src/client/components/client-web-view.vala
@@ -409,8 +409,12 @@ public class ClientWebView : WebKit.WebView {
         return handled;
     }
 
-    // Only allow string-based page loads, and notify but ignore if
-    // the user attempts to click on a link. Deny everything else.
+    // This method is called only when determining if something should
+    // be loaded for display in the web view as the primary
+    // resource. It is not used to determine if sub-resources such as
+    // images or JS will be loaded. So we only allow geary:body loads,
+    // and notify but ignore if the user attempts to click on a link,
+    // and deny everything else.
     private bool on_decide_policy(WebKit.WebView view,
                                   WebKit.PolicyDecision policy,
                                   WebKit.PolicyDecisionType type) {
@@ -420,8 +424,11 @@ public class ClientWebView : WebKit.WebView {
                 (WebKit.NavigationPolicyDecision) policy;
             switch (nav_policy.get_navigation_type()) {
             case WebKit.NavigationType.OTHER:
-                // HTML string load, and maybe other random things?
-                policy.use();
+                if (nav_policy.request.uri == INTERNAL_URL_BODY) {
+                    policy.use();
+                } else {
+                    policy.ignore();
+                }
                 break;
 
             case WebKit.NavigationType.LINK_CLICKED: