summaryrefslogtreecommitdiffstats
path: root/kde/patch/messagelib/messagelib_CVE-2018-19516.patch
diff options
context:
space:
mode:
author Eric Hameleers <alien@slackware.com>2018-12-09 15:39:22 +0100
committer Eric Hameleers <alien@slackware.com>2018-12-09 15:39:22 +0100
commitb8f46a1ec3e6915d83803e5014e8d7676fdb79f8 (patch)
tree51d3478c2ca8b324a9bb6434c052db84681c98da /kde/patch/messagelib/messagelib_CVE-2018-19516.patch
parent8c3e13b71b9b8137f6e807196c31ca6a7cfa6375 (diff)
downloadktown-b8f46a1ec3e6915d83803e5014e8d7676fdb79f8.tar.gz
ktown-b8f46a1ec3e6915d83803e5014e8d7676fdb79f8.tar.xz
KDE messagelib: apply security patch
CVE-2018-19516: HTML email can open browser window automatically.
Diffstat (limited to '')
-rw-r--r--kde/patch/messagelib/messagelib_CVE-2018-19516.patch28
1 files changed, 28 insertions, 0 deletions
diff --git a/kde/patch/messagelib/messagelib_CVE-2018-19516.patch b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch
new file mode 100644
index 0000000..fc44974
--- /dev/null
+++ b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch
@@ -0,0 +1,28 @@
+From 34765909cdf8e55402a8567b48fb288839c61612 Mon Sep 17 00:00:00 2001
+From: Laurent Montel <montel@kde.org>
+Date: Fri, 23 Nov 2018 07:37:02 +0100
+Subject: Exclude Refresh from MetaData (Not necessary)
+
+---
+ messageviewer/src/messagepartthemes/default/defaultrenderer.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
+index 15ffe44..07de293 100644
+--- a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
++++ b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
+@@ -308,6 +308,11 @@ QString processHtml(const QString &htmlSource, QString &extraHead)
+ return htmlSource;
+ }
+ extraHead = s.mid(startIndex + 6, endIndex - startIndex - 6);
++ //Don't authorize to refresh content.
++ if (s.contains(QStringLiteral("http-equiv=\"REFRESH\""), Qt::CaseInsensitive)) {
++ extraHead.clear();
++ }
++
+ s = s.mid(endIndex + 7).trimmed();
+ }
+
+--
+cgit v0.11.2
+