From 88941f14dc1bbbed4aa40d8ea065a80f72489485 Mon Sep 17 00:00:00 2001
From: dimitris <jimitrakis11@gmail.com>
Date: Wed, 13 May 2026 23:12:34 +0200
Subject: [PATCH] Stop re-enabling setAllowFileAccess after the explicit
 setAllowFileAccess(false)

MainActivity.setUpWebview did:

    webSettings.setJavaScriptEnabled(true);
    webSettings.setJavaScriptCanOpenWindowsAutomatically(false);
    webSettings.setAllowFileAccess(false);

    webSettings.setDatabaseEnabled(true);
    ...
    webSettings.setAppCachePath(cachePath);
    webSettings.setAllowFileAccess(true);
    webSettings.setAppCacheEnabled(true);

The first setAllowFileAccess(false) shows the intent: the WebView is
loaded with YouTube (m.youtube.com) and never legitimately needs to
load file:// URLs. The setAllowFileAccess(true) call a few lines
later sits inside the cache-related setup and reads as a refactor
artifact rather than an intentional toggle. setAppCache does not
require file access.

Drop the second setAllowFileAccess(true) line so the initial
setAllowFileAccess(false) decision holds. file:///android_asset/*
loads remain permitted on every supported Android version
regardless of the flag.

Assisted-by: Claude (Anthropic)
---
 app/src/main/java/cz/martykan/webtube/MainActivity.java | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/src/main/java/cz/martykan/webtube/MainActivity.java b/app/src/main/java/cz/martykan/webtube/MainActivity.java
index d5e1bae..60494af 100644
--- a/app/src/main/java/cz/martykan/webtube/MainActivity.java
+++ b/app/src/main/java/cz/martykan/webtube/MainActivity.java
@@ -213,7 +213,6 @@ public void setUpWebview() {
         String cachePath = mApplicationContext
                 .getDir("cache", Context.MODE_PRIVATE).getPath();
         webSettings.setAppCachePath(cachePath);
-        webSettings.setAllowFileAccess(true);
         webSettings.setAppCacheEnabled(true);
         webSettings.setDomStorageEnabled(true);
         webSettings.setCacheMode(WebSettings.LOAD_DEFAULT);