Only enable opting in to rhi profiling when qml debugging is enabled

For security reasons, QML debugging (e.g. QML Profiler) is only usable
when the application had CONFIG+=qml_debug set. Follow the same approach
in the QRhi profiling infrastructure and do nothing if this was not set.

Change-Id: I46ea78a118d79e166a40722befbfc9263aac6680
Reviewed-by: Christian Strømme <christian.stromme@qt.io>

2 files changed, 12 insertions, 2 deletions

diff --git a/src/quick/scenegraph/qsgrhisupport.cpp b/src/quick/scenegraph/qsgrhisupport.cpp
index 86c2ea7806..007739d2d7 100644
--- a/src/quick/scenegraph/qsgrhisupport.cpp
+++ b/src/quick/scenegraph/qsgrhisupport.cpp
@@ -52,6 +52,8 @@
 #include <QOperatingSystemVersion>
 #include <QOffscreenSurface>
 
+#include <QtQml/private/qqmlengine_p.h>
+
 QT_BEGIN_NAMESPACE
 
 #if QT_CONFIG(vulkan)
@@ -737,6 +739,11 @@ void QSGRhiProfileConnection::initialize(QRhi *rhi)
 #ifdef RHI_REMOTE_PROFILER
     const QString profHost = qEnvironmentVariable("QSG_RHI_PROFILE_HOST");
     if (!profHost.isEmpty()) {
+        if (!QQmlEnginePrivate::qml_debugging_enabled) {
+            qWarning("RHI profiling cannot be enabled without QML debugging, for security reasons. "
+                     "Set CONFIG+=qml_debug in the application project.");
+            return;
+        }
         int profPort = qEnvironmentVariableIntValue("QSG_RHI_PROFILE_PORT");
         if (!profPort)
             profPort = 30667;
diff --git a/src/quick/scenegraph/qsgrhisupport_p.h b/src/quick/scenegraph/qsgrhisupport_p.h
index 587ecb2df3..9e81706f41 100644
--- a/src/quick/scenegraph/qsgrhisupport_p.h
+++ b/src/quick/scenegraph/qsgrhisupport_p.h
@@ -154,8 +154,11 @@ private:
 };
 
 // Sends QRhi resource statistics over a QTcpSocket. To be initialized by the
-// renderloop when QSGRhiSupport::isProfilingRequested() is true. Will not do
-// anything unless extra env vars (QSG_RHI_PROFILE_HOST) are set.
+// renderloop when QSGRhiSupport::isProfilingRequested() is true. From the
+// applications' side this is enabled by setting the env.vars. QSG_RHI_PROFILE=1
+// and QSG_RHI_PROFILE_HOST=<address>. For security, this is also tied to
+// CONFIG+=qml_debug in the application (just like QML debugging), so it won't
+// be doing anything otherwise, even if the env vars are set.
 class QSGRhiProfileConnection
 {
 public: