From f5cc97d014a99a2fb9a9dd990dd63304dcc1d448 Mon Sep 17 00:00:00 2001
From: lunar-seal <lunar-seal@ff15.eu>
Date: Fri, 31 Jul 2026 19:02:25 +0200
Subject: [PATCH 1/2] fix: ask user for location permission on cef

---
 src-tauri/src/main.rs | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs
index 034c508ca..8fdd89c9e 100644
--- a/src-tauri/src/main.rs
+++ b/src-tauri/src/main.rs
@@ -21,7 +21,6 @@ fn prompt_cef_permission(message: String, tx: std::sync::mpsc::Sender<bool>) {
         dialog.set_title("Permission request");
 
         let tx = std::cell::RefCell::new(Some(tx));
-        let dialog_ptr = dialog.clone();
         dialog.connect_response(move |dlg, response| {
             if let Some(tx) = tx.take() {
                 let _ = tx.send(matches!(response, ResponseType::Yes));
@@ -100,7 +99,7 @@ fn main() {
             return;
         }
 
-        // Allow call media capture (mic, camera, screen-share) for our webview.
+        // Allow call media capture (mic, camera, screen-share) and geolocation for our webview.
         // Cache granted permissions so we only prompt once per kind.
         use std::collections::HashSet;
         use std::sync::{Mutex, OnceLock};
@@ -114,7 +113,7 @@ fn main() {
                 return responder.deny(DenyReason::NoPolicy);
             }
 
-            let media_kinds: Vec<PermissionKind> = request
+            let permission_kinds: Vec<PermissionKind> = request
                 .kinds
                 .iter()
                 .filter(|kind| {
@@ -125,17 +124,18 @@ fn main() {
                             | PermissionKind::CameraPanTiltZoom
                             | PermissionKind::ScreenCapture
                             | PermissionKind::CapturedSurfaceControl
+                            | PermissionKind::Geolocation
                     )
                 })
                 .cloned()
                 .collect();
 
-            if media_kinds.is_empty() {
+            if permission_kinds.is_empty() {
                 return responder.deny(DenyReason::NoPolicy);
             }
 
             // Check cache: if all requested kinds were already granted, allow immediately.
-            let kind_names: Vec<&'static str> = media_kinds
+            let kind_names: Vec<&'static str> = permission_kinds
                 .iter()
                 .map(|k| match k {
                     PermissionKind::Microphone => "mic",
@@ -143,6 +143,7 @@ fn main() {
                     PermissionKind::ScreenCapture | PermissionKind::CapturedSurfaceControl => {
                         "screen"
                     }
+                    PermissionKind::Geolocation => "geolocation",
                     _ => "other",
                 })
                 .collect();
@@ -154,14 +155,15 @@ fn main() {
                 }
             }
 
-            let msg = match media_kinds.as_slice() {
+            let msg = match permission_kinds.as_slice() {
                 [PermissionKind::Microphone] => "Sable wants to access your microphone.",
                 [PermissionKind::Camera] => "Sable wants to access your camera.",
                 [PermissionKind::ScreenCapture] | [PermissionKind::CapturedSurfaceControl] => {
                     "Sable wants to share your screen."
                 }
-                _ if media_kinds.contains(&PermissionKind::Microphone)
-                    && media_kinds.contains(&PermissionKind::Camera) =>
+                [PermissionKind::Geolocation] => "Sable wants to access your location.",
+                _ if permission_kinds.contains(&PermissionKind::Microphone)
+                    && permission_kinds.contains(&PermissionKind::Camera) =>
                 {
                     "Sable wants to access your microphone and camera."
                 }

From c79b3670f930b5218a9382fb653a746af3124667 Mon Sep 17 00:00:00 2001
From: lunar-seal <lunar-seal@ff15.eu>
Date: Fri, 31 Jul 2026 19:25:53 +0200
Subject: [PATCH 2/2] fix(cef): check origin in permission policy

---
 src-tauri/src/main.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src-tauri/src/main.rs b/src-tauri/src/main.rs
index 8fdd89c9e..b797edc00 100644
--- a/src-tauri/src/main.rs
+++ b/src-tauri/src/main.rs
@@ -109,7 +109,12 @@ fn main() {
         tauri_runtime_cef::set_permission_policy(move |request, responder| {
             use tauri_runtime_cef::{DenyReason, PermissionKind};
 
-            if request.webview_label != "main" {
+            if request.webview_label != "main"
+                || !request
+                    .origin
+                    .as_ref()
+                    .is_some_and(|origin| origin.is_app_local())
+            {
                 return responder.deny(DenyReason::NoPolicy);
             }