diff options
author | Eric Hameleers <alien@slackware.com> | 2018-02-10 19:16:05 +0100 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2018-02-10 19:16:05 +0100 |
commit | 8e2d32c04e4c2684e6cd5976a955f8ee569afd61 (patch) | |
tree | c6fd1bfc49445ef974cc3857cdf803e2a0a97a70 /kde/patch/plasma-workspace/plasma-workspace_kdebug389815.patch | |
parent | d1f0b61f3bf3496ac013d67bc39fa40a68a92478 (diff) | |
download | ktown-8e2d32c04e4c2684e6cd5976a955f8ee569afd61.tar.gz ktown-8e2d32c04e4c2684e6cd5976a955f8ee569afd61.tar.xz |
Disable patches that were applied upstream
Diffstat (limited to '')
-rw-r--r-- | kde/patch/plasma-workspace/plasma-workspace_kdebug389815.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/kde/patch/plasma-workspace/plasma-workspace_kdebug389815.patch b/kde/patch/plasma-workspace/plasma-workspace_kdebug389815.patch new file mode 100644 index 0000000..e2f1e48 --- /dev/null +++ b/kde/patch/plasma-workspace/plasma-workspace_kdebug389815.patch @@ -0,0 +1,32 @@ +From f32002ce50edc3891f1fa41173132c820b917d57 Mon Sep 17 00:00:00 2001 +From: Marco Martin <notmart@gmail.com> +Date: Mon, 5 Feb 2018 13:12:51 +0100 +Subject: Make sure device paths are quoted + +in the case a vfat removable device has $() or `` in its label, +such as $(touch foo) the quoted command may get executed, +leaving an attack vector. Use KMacroExpander::expandMacrosShellQuote +to make sure everything is quoted and not interpreted as a command + +BUG:389815 +--- + soliduiserver/deviceserviceaction.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/soliduiserver/deviceserviceaction.cpp b/soliduiserver/deviceserviceaction.cpp +index f49c967..738b27c 100644 +--- a/soliduiserver/deviceserviceaction.cpp ++++ b/soliduiserver/deviceserviceaction.cpp +@@ -158,7 +158,7 @@ void DelayedExecutor::delayedExecute(const QString &udi) + + QString exec = m_service.exec(); + MacroExpander mx(device); +- mx.expandMacros(exec); ++ mx.expandMacrosShellQuote(exec); + + KRun::runCommand(exec, QString(), m_service.icon(), 0); + deleteLater(); +-- +cgit v0.11.2 + + |