From a73fd36476f72e5490ac844c4b46a3485c1d1600 Mon Sep 17 00:00:00 2001
From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Tue, 15 Dec 2020 08:10:54 +0530
Subject: [PATCH] Only open external URLs in response to clicks. Fixes #1908041
 [ebook-viewer and ebook-edit: iFrame in ePub opens
 browser](https://bugs.launchpad.net/calibre/+bug/1908041)

---
 src/calibre/gui2/tweak_book/preview.py | 5 +++--
 src/calibre/gui2/viewer/web_view.py    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/calibre/gui2/tweak_book/preview.py b/src/calibre/gui2/tweak_book/preview.py
index 456f8eadd7..9fb7c502a4 100644
--- a/src/calibre/gui2/tweak_book/preview.py
+++ b/src/calibre/gui2/tweak_book/preview.py
@@ -25,7 +25,7 @@ from calibre.constants import (
 )
 from calibre.ebooks.oeb.base import OEB_DOCS, XHTML_MIME, serialize
 from calibre.ebooks.oeb.polish.parsing import parse
-from calibre.gui2 import NO_URL_FORMATTING, error_dialog, is_dark_theme, open_url
+from calibre.gui2 import NO_URL_FORMATTING, error_dialog, is_dark_theme, safe_open_url
 from calibre.gui2.palette import dark_color, dark_link_color, dark_text_color
 from calibre.gui2.tweak_book import TOP, actions, current_container, editors, tprefs
 from calibre.gui2.tweak_book.file_list import OpenWithHandler
@@ -319,7 +319,8 @@ class WebPage(QWebEnginePage):
             return True
         if url.scheme() in (FAKE_PROTOCOL, 'data'):
             return True
-        open_url(url)
+        if req_type == QWebEnginePage.NavigationType.NavigationTypeLinkClicked:
+            safe_open_url(url)
         return False
 
     def go_to_anchor(self, anchor):
diff --git a/src/calibre/gui2/viewer/web_view.py b/src/calibre/gui2/viewer/web_view.py
index aaed12d86c..d393d46103 100644
--- a/src/calibre/gui2/viewer/web_view.py
+++ b/src/calibre/gui2/viewer/web_view.py
@@ -369,7 +369,7 @@ class WebPage(QWebEnginePage):
             return True
         if url.scheme() in (FAKE_PROTOCOL, 'data'):
             return True
-        if url.scheme() in ('http', 'https'):
+        if url.scheme() in ('http', 'https') and req_type == QWebEnginePage.NavigationType.NavigationTypeLinkClicked:
             safe_open_url(url)
         prints('Blocking navigation request to:', url.toString())
         return False