Compare commits
No commits in common. 'epel9' and 'i8ce' have entirely different histories.
@ -1,66 +1 @@
|
||||
/kconfig-5.46.0.tar.xz
|
||||
/kconfig-5.47.0.tar.xz
|
||||
/kconfig-5.48.0.tar.xz
|
||||
/kconfig-5.49.0.tar.xz
|
||||
/kconfig-5.50.0.tar.xz
|
||||
/kconfig-5.51.0.tar.xz
|
||||
/kconfig-5.52.0.tar.xz
|
||||
/kconfig-5.53.0.tar.xz
|
||||
/kconfig-5.54.0.tar.xz
|
||||
/kconfig-5.55.0.tar.xz
|
||||
/kconfig-5.56.0.tar.xz
|
||||
/kconfig-5.57.0.tar.xz
|
||||
/kconfig-5.58.0.tar.xz
|
||||
/kconfig-5.59.0.tar.xz
|
||||
/kconfig-5.60.0.tar.xz
|
||||
/kconfig-5.61.0.tar.xz
|
||||
/kconfig-5.62.0.tar.xz
|
||||
/kconfig-5.63.0.tar.xz
|
||||
/kconfig-5.64.0.tar.xz
|
||||
/kconfig-5.65.0.tar.xz
|
||||
/kconfig-5.66.0.tar.xz
|
||||
/kconfig-5.67.0.tar.xz
|
||||
/kconfig-5.68.0.tar.xz
|
||||
/kconfig-5.69.0.tar.xz
|
||||
/kconfig-5.70.0.tar.xz
|
||||
/kconfig-5.71.0.tar.xz
|
||||
/kconfig-5.72.0.tar.xz
|
||||
/kconfig-5.73.0.tar.xz
|
||||
/kconfig-5.74.0.tar.xz
|
||||
/kconfig-5.75.0.tar.xz
|
||||
/kconfig-5.76.0.tar.xz
|
||||
/kconfig-5.77.0.tar.xz
|
||||
/kconfig-5.78.0.tar.xz
|
||||
/kconfig-5.79.0.tar.xz
|
||||
/kconfig-5.80.0.tar.xz
|
||||
/kconfig-5.81.0.tar.xz
|
||||
/kconfig-5.82.0.tar.xz
|
||||
/kconfig-5.83.0.tar.xz
|
||||
/kconfig-5.85.0.tar.xz
|
||||
/kconfig-5.86.0.tar.xz
|
||||
/kconfig-5.87.0.tar.xz
|
||||
/kconfig-5.88.0.tar.xz
|
||||
/kconfig-5.89.0.tar.xz
|
||||
/kconfig-5.90.0.tar.xz
|
||||
/kconfig-5.91.0.tar.xz
|
||||
/kconfig-5.92.0.tar.xz
|
||||
./kconfig-5.93.tar.xz
|
||||
/kconfig-5.94.0.tar.xz
|
||||
/kconfig-5.96.0.tar.xz
|
||||
/kconfig-5.97.0.tar.xz
|
||||
/kconfig-5.98.0.tar.xz
|
||||
/kconfig-5.99.0.tar.xz
|
||||
/kconfig-5.100.0.tar.xz
|
||||
/kconfig-5.101.0.tar.xz
|
||||
/kconfig-5.102.0.tar.xz
|
||||
/kconfig-5.103.0.tar.xz
|
||||
/kconfig-5.104.0.tar.xz
|
||||
/kconfig-5.105.0.tar.xz
|
||||
/kconfig-5.106.0.tar.xz
|
||||
/kconfig-5.107.0.tar.xz
|
||||
/kconfig-5.108.0.tar.xz
|
||||
/kconfig-5.109.0.tar.xz
|
||||
/kconfig-5.110.0.tar.xz
|
||||
/kconfig-5.111.0.tar.xz
|
||||
/kconfig-5.113.0.tar.xz
|
||||
/kconfig-5.115.0.tar.xz
|
||||
SOURCES/kconfig-5.96.0.tar.xz
|
||||
|
||||
@ -0,0 +1 @@
|
||||
f0919532f9d152f5b00df16d9c7460f095a7d57a SOURCES/kconfig-5.96.0.tar.xz
|
||||
@ -0,0 +1,148 @@
|
||||
From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001
|
||||
From: David Faure <faure@kde.org>
|
||||
Date: Wed, 7 Aug 2019 09:35:36 +0200
|
||||
Subject: [PATCH 12/12] Security: remove support for $(...) in config keys with
|
||||
[$e] marker.
|
||||
|
||||
Summary:
|
||||
It is very unclear at this point what a valid use case for this feature
|
||||
would possibly be. The old documentation only mentions $(hostname) as
|
||||
an example, which can be done with $HOSTNAME instead.
|
||||
|
||||
Note that $(...) is still supported in Exec lines of desktop files,
|
||||
this does not require [$e] anyway (and actually works better without it,
|
||||
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
|
||||
|
||||
Test Plan:
|
||||
ctest passes; various testcases with $(...) in desktop files,
|
||||
directory files, and config files, no longer execute commands.
|
||||
|
||||
Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
|
||||
|
||||
Reviewed By: mdawson, davidedmundson
|
||||
|
||||
Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
|
||||
|
||||
Tags: #frameworks
|
||||
|
||||
Differential Revision: https://phabricator.kde.org/D22979
|
||||
---
|
||||
autotests/kconfigtest.cpp | 10 ++--------
|
||||
docs/options.md | 11 ++++-------
|
||||
src/core/kconfig.cpp | 37 +------------------------------------
|
||||
3 files changed, 7 insertions(+), 51 deletions(-)
|
||||
|
||||
diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp
|
||||
index 410b5b8..9af3b46 100644
|
||||
--- a/autotests/kconfigtest.cpp
|
||||
+++ b/autotests/kconfigtest.cpp
|
||||
@@ -38,7 +38,7 @@
|
||||
#include <utime.h>
|
||||
#endif
|
||||
#ifndef Q_OS_WIN
|
||||
-#include <unistd.h> // gethostname
|
||||
+#include <unistd.h> // getuid
|
||||
#endif
|
||||
|
||||
KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing)
|
||||
@@ -546,14 +546,8 @@ void KConfigTest::testPath()
|
||||
QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH));
|
||||
QVERIFY(group.hasKey("URL"));
|
||||
QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH));
|
||||
-#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC)
|
||||
- // I don't know if this will work on windows
|
||||
- // This test hangs on OS X
|
||||
QVERIFY(group.hasKey("hostname"));
|
||||
- char hostname[256];
|
||||
- QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0);
|
||||
- QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname));
|
||||
-#endif
|
||||
+ QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name
|
||||
QVERIFY(group.hasKey("noeol"));
|
||||
QCOMPARE(group.readEntry("noeol", QString()), QString("foo"));
|
||||
|
||||
diff --git a/docs/options.md b/docs/options.md
|
||||
index c634c00..4a6e9bc 100644
|
||||
--- a/docs/options.md
|
||||
+++ b/docs/options.md
|
||||
@@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular).
|
||||
Shell Expansion
|
||||
---------------
|
||||
|
||||
-If an entry is marked with `$e`, environment variables and shell commands will
|
||||
-be expanded.
|
||||
+If an entry is marked with `$e`, environment variables will be expanded.
|
||||
|
||||
Name[$e]=$USER
|
||||
- Host[$e]=$(hostname)
|
||||
|
||||
When the "Name" entry is read `$USER` will be replaced with the value of the
|
||||
-`$USER` environment variable, and `$(hostname)` will be replaced with the output
|
||||
-of the `hostname` command.
|
||||
+`$USER` environment variable.
|
||||
|
||||
-Note that the application will replace `$USER` and `$(hostname)` with their
|
||||
-respective expanded values after saving. To prevent this combine the `$e` option
|
||||
+Note that the application will replace `$USER` with its
|
||||
+expanded value after saving. To prevent this combine the `$e` option
|
||||
with `$i` (immmutable) option. For example:
|
||||
|
||||
Name[$ei]=$USER
|
||||
diff --git a/src/core/kconfig.cpp b/src/core/kconfig.cpp
|
||||
index e1b11ed..f6824ce 100644
|
||||
--- a/src/core/kconfig.cpp
|
||||
+++ b/src/core/kconfig.cpp
|
||||
@@ -28,19 +28,6 @@
|
||||
#include <cstdlib>
|
||||
#include <fcntl.h>
|
||||
|
||||
-#ifdef _MSC_VER
|
||||
-static inline FILE *popen(const char *cmd, const char *mode)
|
||||
-{
|
||||
- return _popen(cmd, mode);
|
||||
-}
|
||||
-static inline int pclose(FILE *stream)
|
||||
-{
|
||||
- return _pclose(stream);
|
||||
-}
|
||||
-#else
|
||||
-#include <unistd.h>
|
||||
-#endif
|
||||
-
|
||||
#include "kconfigbackend_p.h"
|
||||
#include "kconfiggroup.h"
|
||||
|
||||
@@ -183,29 +170,7 @@ QString KConfigPrivate::expandString(const QString &value)
|
||||
int nDollarPos = aValue.indexOf(QLatin1Char('$'));
|
||||
while (nDollarPos != -1 && nDollarPos + 1 < aValue.length()) {
|
||||
// there is at least one $
|
||||
- if (aValue[nDollarPos + 1] == QLatin1Char('(')) {
|
||||
- int nEndPos = nDollarPos + 1;
|
||||
- // the next character is not $
|
||||
- while ((nEndPos <= aValue.length()) && (aValue[nEndPos] != QLatin1Char(')'))) {
|
||||
- nEndPos++;
|
||||
- }
|
||||
- nEndPos++;
|
||||
- QString cmd = aValue.mid(nDollarPos + 2, nEndPos - nDollarPos - 3);
|
||||
-
|
||||
- QString result;
|
||||
-
|
||||
-// FIXME: wince does not have pipes
|
||||
-#ifndef _WIN32_WCE
|
||||
- FILE *fs = popen(QFile::encodeName(cmd).data(), "r");
|
||||
- if (fs) {
|
||||
- QTextStream ts(fs, QIODevice::ReadOnly);
|
||||
- result = ts.readAll().trimmed();
|
||||
- pclose(fs);
|
||||
- }
|
||||
-#endif
|
||||
- aValue.replace(nDollarPos, nEndPos - nDollarPos, result);
|
||||
- nDollarPos += result.length();
|
||||
- } else if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
|
||||
+ if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
|
||||
int nEndPos = nDollarPos + 1;
|
||||
// the next character is not $
|
||||
QStringRef aVarName;
|
||||
--
|
||||
2.21.0
|
||||
|
||||
Loading…
Reference in new issue