diff options
author | Eric Hameleers <alien@slackware.com> | 2018-12-09 15:39:22 +0100 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2018-12-09 15:39:22 +0100 |
commit | b8f46a1ec3e6915d83803e5014e8d7676fdb79f8 (patch) | |
tree | 51d3478c2ca8b324a9bb6434c052db84681c98da /kde/patch | |
parent | 8c3e13b71b9b8137f6e807196c31ca6a7cfa6375 (diff) | |
download | ktown-b8f46a1ec3e6915d83803e5014e8d7676fdb79f8.tar.gz ktown-b8f46a1ec3e6915d83803e5014e8d7676fdb79f8.tar.xz |
KDE messagelib: apply security patch
CVE-2018-19516: HTML email can open browser window automatically.
Diffstat (limited to 'kde/patch')
-rw-r--r-- | kde/patch/messagelib.patch | 4 | ||||
-rw-r--r-- | kde/patch/messagelib/messagelib_CVE-2018-19516.patch | 28 |
2 files changed, 32 insertions, 0 deletions
diff --git a/kde/patch/messagelib.patch b/kde/patch/messagelib.patch new file mode 100644 index 0000000..982de5c --- /dev/null +++ b/kde/patch/messagelib.patch @@ -0,0 +1,4 @@ +# CVE-2018-19516: HTML email can open browser window automatically. +# Fixed in messagelib of KDE Applications 18.12.0. +cat $CWD/patch/messagelib/messagelib_CVE-2018-19516.patch | patch -p1 --verbose || { touch ${SLACK_KDE_BUILD_DIR}/${PKGNAME}.failed ; continue ; } + diff --git a/kde/patch/messagelib/messagelib_CVE-2018-19516.patch b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch new file mode 100644 index 0000000..fc44974 --- /dev/null +++ b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch @@ -0,0 +1,28 @@ +From 34765909cdf8e55402a8567b48fb288839c61612 Mon Sep 17 00:00:00 2001 +From: Laurent Montel <montel@kde.org> +Date: Fri, 23 Nov 2018 07:37:02 +0100 +Subject: Exclude Refresh from MetaData (Not necessary) + +--- + messageviewer/src/messagepartthemes/default/defaultrenderer.cpp | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp +index 15ffe44..07de293 100644 +--- a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp ++++ b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp +@@ -308,6 +308,11 @@ QString processHtml(const QString &htmlSource, QString &extraHead) + return htmlSource; + } + extraHead = s.mid(startIndex + 6, endIndex - startIndex - 6); ++ //Don't authorize to refresh content. ++ if (s.contains(QStringLiteral("http-equiv=\"REFRESH\""), Qt::CaseInsensitive)) { ++ extraHead.clear(); ++ } ++ + s = s.mid(endIndex + 7).trimmed(); + } + +-- +cgit v0.11.2 + |