import libreoffice-6.4.7.2-13.el8

2 years ago · b9ee6f9f9b
commit b9ee6f9f9b
53 changed files with 27356 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,15 @@
+SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip
+SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
+SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
+SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
+SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+SOURCES/libreoffice-6.4.7.2.tar.xz
+SOURCES/libreoffice-base-symbolic.svg
+SOURCES/libreoffice-calc-symbolic.svg
+SOURCES/libreoffice-draw-symbolic.svg
+SOURCES/libreoffice-help-6.4.7.2.tar.xz
+SOURCES/libreoffice-impress-symbolic.svg
+SOURCES/libreoffice-main-symbolic.svg
+SOURCES/libreoffice-math-symbolic.svg
+SOURCES/libreoffice-translations-6.4.7.2.tar.xz
+SOURCES/libreoffice-writer-symbolic.svg
--- a/.libreoffice.metadata
+++ b/.libreoffice.metadata
@ -0,0 +1,15 @@
+7168b0f40aa5c72267899601c116d2348d2f56ec SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip
+0619ed3a89644bef318df67db12045b2b590585b SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
+d336802a36ed2c87dd243e7c2f1d0542dace5cca SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
+2d49e11b0b711970f494294dc3698f05eb294853 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
+7b5fd93d787fbc6d9c2d4025d543730ee8dc4559 SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+b29d8cdb3db8d6b317e1cb9117b020d7e676e601 SOURCES/libreoffice-6.4.7.2.tar.xz
+54fc749ba924f9ca4e0391caaf579ab344302038 SOURCES/libreoffice-base-symbolic.svg
+9de544172d736d59589767000c1f657034a5d53d SOURCES/libreoffice-calc-symbolic.svg
+0f6dc4726da0920869354fbe4b2924f9ac569b4a SOURCES/libreoffice-draw-symbolic.svg
+ca7e087ef62f30c033db84ceb0f6a4021f53653e SOURCES/libreoffice-help-6.4.7.2.tar.xz
+8c74dd667c660cc643c4d715dd50491ba92146d5 SOURCES/libreoffice-impress-symbolic.svg
+c77acd04a7647b09745f9424ab0f65d52dfcd397 SOURCES/libreoffice-main-symbolic.svg
+3857a55644148eb25ed1a594bd00d1262761fb39 SOURCES/libreoffice-math-symbolic.svg
+0f74fd6286e71ff2b7c7bc01f41c8972e354d81c SOURCES/libreoffice-translations-6.4.7.2.tar.xz
+d4f0674ad46a832120db956cc01a27fdc2060458 SOURCES/libreoffice-writer-symbolic.svg
--- a/SOURCES/0001-0.5.1-is-sufficient.patch
+++ b/SOURCES/0001-0.5.1-is-sufficient.patch
@ -0,0 +1,46 @@
+From ceac69bff953ebd9b54a1f3a032079523c4414d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Sun, 25 Oct 2020 20:23:39 +0000
+Subject: [PATCH] 0.5.1 is sufficient
+
+Change-Id: I710a83de8f261d6164eb760d3290c963a5bbe5e1
+---
+ configure.ac | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index a6696df15f06..c17fdf5b0d22 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -7050,7 +7050,7 @@ dnl Check for system libcmis
+ dnl ===================================================================
+ # libcmis requires curl and we can't build curl for iOS
+ if test $_os != iOS; then
+-    libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.5 >= 0.5.2])
+    libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.5 >= 0.5.0])
+     ENABLE_LIBCMIS=TRUE
+ else
+     ENABLE_LIBCMIS=
+@@ -7090,19 +7090,6 @@ elif test "$GCC" = "yes" -o "$COM_IS_CLANG" = TRUE; then
+             #include <functional>
+             #include <vector>
+ 
+-            #if defined SYSTEM_LIBCMIS
+-            // See ucb/source/ucp/cmis/auth_provider.hxx:
+-            #if !defined __clang__
+-            #pragma GCC diagnostic push
+-            #pragma GCC diagnostic ignored "-Wdeprecated"
+-            #pragma GCC diagnostic ignored "-Wunused-but-set-parameter"
+-            #endif
+-            #include <libcmis/libcmis.hxx>
+-            #if !defined __clang__
+-            #pragma GCC diagnostic pop
+-            #endif
+-            #endif
+-
+             void f(std::vector<int> & v, std::function<bool(int, int)> fn) {
+                 std::sort(v.begin(), v.end(), fn);
+             }
+-- 
+2.26.2
+
--- a/SOURCES/0001-1.2.25-is-sufficient.patch
+++ b/SOURCES/0001-1.2.25-is-sufficient.patch
@ -0,0 +1,26 @@
+From 92c95c8c3724f267e57827f69f93ef4e6387f793 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Sun, 25 Oct 2020 21:14:10 +0000
+Subject: [PATCH] 1.2.25 is sufficient
+
+Change-Id: Ie184fbaaf6eea0ae1a39bf142d3391768be9607d
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index a62c131a6d0e..c815ea2c3f8b 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -8364,7 +8364,7 @@ libo_CHECK_SYSTEM_MODULE([expat], [EXPAT], [expat])
+ dnl ===================================================================
+ dnl Check for system xmlsec
+ dnl ===================================================================
+-libo_CHECK_SYSTEM_MODULE([xmlsec], [XMLSEC], [xmlsec1-nss >= 1.2.28])
+libo_CHECK_SYSTEM_MODULE([xmlsec], [XMLSEC], [xmlsec1-nss >= 1.2.25])
+ 
+ AC_MSG_CHECKING([whether to enable Embedded OpenType support])
+ if test "$_os" != "WINNT" -a "$_os" != "Darwin" -a "$enable_eot" = "yes"; then
+-- 
+2.26.2
+
--- a/SOURCES/0001-CVE-2021-25636.patch
+++ b/SOURCES/0001-CVE-2021-25636.patch
@ -0,0 +1,69 @@
+From ae1bd20a2d4d7b7d64edc3b06d7f901c05175b7d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 20 Dec 2021 17:05:44 +0000
+Subject: [PATCH] only use X509Data
+
+Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+(cherry picked from commit b0404f80577de9ff69e58390c6f6ef949fdb0139)
+---
+ .../source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx      | 6 ++++++
+ xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx      | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+index db400e6..39f9d7f 100644
+--- a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+++ b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+@@ -21,6 +21,8 @@
+ #include <sal/log.hxx>
+ #include <rtl/uuid.h>
+ 
+#include <xmlsec/mscng/x509.h>
+
+ #include <com/sun/star/xml/crypto/SecurityOperationStatus.hpp>
+ #include <com/sun/star/xml/crypto/XXMLSignature.hpp>
+ 
+@@ -229,6 +231,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
+     // We do certificate verification ourselves.
+     pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
+    // limit possible key data to valid X509 certificates only, no KeyValues
+    if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
+        throw RuntimeException("failed to limit allowed key data");
+
+     //Verify signature
+     //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
+     //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if
+diff --git a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+index 827580b..8f4d6f8 100644
+--- a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+++ b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+@@ -19,6 +19,8 @@
+ 
+ #include <sal/config.h>
+ 
+#include <xmlsec/nss/x509.h>
+
+ #include <xmlelementwrapper_xmlsecimpl.hxx>
+ #include <xmlsec/xmlstreamio.hxx>
+ #include <xmlsec/errorcallback.hxx>
+@@ -243,6 +245,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
+         // We do certificate verification ourselves.
+         pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
+        // limit possible key data to valid X509 certificates only, no KeyValues
+        if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
+            throw RuntimeException("failed to limit allowed key data");
+
+         //Verify signature
+         int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );
+ 
+-- 
+2.33.1
+
--- a/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
+++ b/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
@ -0,0 +1,63 @@
+From 77f30ada1156ca1e1357776fea8e9dc113f6898d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 3 Mar 2022 14:22:37 +0000
+Subject: [PATCH 1/4] CVE-2022-26305 compare authors using Thumbprint
+
+Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8)
+---
+ .../component/documentdigitalsignatures.cxx   | 23 +++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+index b9066ea92cac..5a21c8421bec 100644
+--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+@@ -19,9 +19,10 @@
+ 
+ #include <resourcemanager.hxx>
+ 
+-#include <digitalsignaturesdialog.hxx>
+#include <certificate.hxx>
+ #include <certificatechooser.hxx>
+ #include <certificateviewer.hxx>
+#include <digitalsignaturesdialog.hxx>
+ #include <macrosecurity.hxx>
+ #include <biginteger.hxx>
+ #include <strings.hrc>
+@@ -666,9 +667,23 @@ sal_Bool DocumentDigitalSignatures::isAuthorTrusted(
+     Sequence< SvtSecurityOptions::Certificate > aTrustedAuthors = SvtSecurityOptions().GetTrustedAuthors();
+ 
+     return std::any_of(aTrustedAuthors.begin(), aTrustedAuthors.end(),
+-        [&xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
+-            return xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName())
+-                && ( rAuthor[1] == sSerialNum );
+        [this, &xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
+            if (!xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName()))
+                return false;
+            if (rAuthor[1] != sSerialNum)
+                return false;
+
+            DocumentSignatureManager aSignatureManager(mxCtx, {});
+            if (!aSignatureManager.init())
+                return false;
+            uno::Reference<css::security::XCertificate> xCert = aSignatureManager.getSecurityEnvironment()->createCertificateFromAscii(rAuthor[2]);
+
+            auto pAuthor = dynamic_cast<xmlsecurity::Certificate*>(xAuthor.get());
+            auto pCert = dynamic_cast<xmlsecurity::Certificate*>(xCert.get());
+            if (pAuthor && pCert)
+                return pCert->getSHA256Thumbprint() == pAuthor->getSHA256Thumbprint();
+
+            return xCert->getSHA1Thumbprint() == xAuthor->getSHA1Thumbprint();
+         });
+ }
+ 
+-- 
+2.37.1
+
--- a/SOURCES/0001-CVE-2022-3140.patch
+++ b/SOURCES/0001-CVE-2022-3140.patch
@ -0,0 +1,279 @@
+From 3831e68bffc233f581e3eb1cb3c7ed925daab86f Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Tue, 30 Aug 2022 14:04:52 +0200
+Subject: [PATCH] Filter out unwanted command URIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139225
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 27d29f7df428885865a8e2313283839b20f2a34b)
+Conflicts:
+	desktop/source/app/cmdlineargs.cxx
+
+Change-Id: I0b7e5329af8cc053d14d5c60ec14fe7f364ef993
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139182
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit da291e2960b75153f41d440a1b41961567432e8c)
+
+These commands are always URLs already
+
+Change-Id: I5083765c879689d7f933bbe00ad70bb68e635a21
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139042
+Tested-by: Jean-Pierre Ledure <jp@ledure.be>
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit e61701e1ee6763de72b397e6ade1124eca9400f3)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138980
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 5b4025bb56999f5c895c6f7e0b52f521800d65b0)
+
+check IFrame "FrameURL" target
+
+similiar to
+
+commit b3edf85e0fe6ca03dc26e1bf531be82193bc9627
+Date:   Wed Aug 7 17:37:11 2019 +0100
+
+    warn on load when a document binds an event to a macro
+
+Change-Id: Iea888b1c083d2dc69ec322309ac9ae8c5e5eb315
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139059
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit c7450d0b9d02c64ae3da467d329040787039767e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139117
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+(cherry picked from commit f5e3b0a7966d7d28817292adbb58fb43f28b7c6d)
+
+check impress/calc IFrame "FrameURL" target
+
+similar to
+
+commit c7450d0b9d02c64ae3da467d329040787039767e
+Date:   Tue Aug 30 17:01:08 2022 +0100
+
+    check IFrame "FrameURL" target
+
+Change-Id: Ibf28c29acb4476830431d02772f3ecd4b23a6a27
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139495
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit d0312786571221c2dd4f63fa69f6f0489d7d39ec)
+---
+ desktop/source/app/cmdlineargs.cxx   | 10 +++++++++-
+ sfx2/source/appl/macroloader.cxx     |  9 +++++++--
+ sfx2/source/doc/iframe.cxx           | 21 ++++++++++++++++-----
+ sfx2/source/inc/macroloader.hxx      |  2 ++
+ sw/source/filter/html/htmlplug.cxx   |  7 ++++++-
+ sw/source/filter/xml/xmltexti.cxx    |  9 +++++++--
+ wizards/source/access2base/DoCmd.xba |  2 +-
+ xmloff/source/draw/ximpshap.cxx      |  4 ++++
+ 8 files changed, 52 insertions(+), 12 deletions(-)
+
+diff --git a/desktop/source/app/cmdlineargs.cxx b/desktop/source/app/cmdlineargs.cxx
+index 381147c..5babfbe 100644
+--- a/desktop/source/app/cmdlineargs.cxx
+++ b/desktop/source/app/cmdlineargs.cxx
+@@ -27,6 +27,7 @@
+ 
+ #include "cmdlineargs.hxx"
+ #include <tools/stream.hxx>
+#include <tools/urlobj.hxx>
+ #include <vcl/svapp.hxx>
+ #include <rtl/uri.hxx>
+ #include <rtl/ustring.hxx>
+@@ -169,7 +170,14 @@ CommandLineEvent CheckOfficeURI(/* in,out */ OUString& arg, CommandLineEvent cur
+     }
+     if (nURIlen < 0)
+         nURIlen = rest2.getLength();
+-    arg = rest2.copy(0, nURIlen);
+    auto const uri = rest2.copy(0, nURIlen);
+    if (INetURLObject(uri).GetProtocol() == INetProtocol::Macro) {
+        // Let the "Open" machinery process the full command URI (leading to failure, by intention,
+        // as the "Open" machinery does not know about those command URI schemes):
+        curEvt = CommandLineEvent::Open;
+    } else {
+        arg = uri;
+    }
+     return curEvt;
+ }
+ 
+diff --git a/sfx2/source/appl/macroloader.cxx b/sfx2/source/appl/macroloader.cxx
+index 98e036e..b50d1e6 100644
+--- a/sfx2/source/appl/macroloader.cxx
+++ b/sfx2/source/appl/macroloader.cxx
+@@ -76,10 +76,10 @@ css::uno::Sequence<OUString> SAL_CALL SfxMacroLoader::getSupportedServiceNames()
+     return aSeq;
+ }
+ 
+-SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+SfxObjectShell* SfxMacroLoader::GetObjectShell(const Reference <XFrame>& xFrame)
+ {
+     SfxObjectShell* pDocShell = nullptr;
+-    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
+
+     if ( xFrame.is() )
+     {
+         SfxFrame* pFrame=nullptr;
+@@ -96,6 +96,11 @@ SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+     return pDocShell;
+ }
+ 
+SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+{
+    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
+    return SfxMacroLoader::GetObjectShell(xFrame);
+}
+ 
+ uno::Reference<frame::XDispatch> SAL_CALL SfxMacroLoader::queryDispatch(
+     const util::URL&   aURL            ,
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 8b12715..b5291b2 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -39,11 +39,13 @@
+ #include <svl/ownlist.hxx>
+ #include <svl/itemprop.hxx>
+ #include <sfx2/frmdescr.hxx>
+#include <sfx2/objsh.hxx>
+ #include <sfx2/sfxdlg.hxx>
+ #include <sfx2/sfxsids.hrc>
+ #include <toolkit/helper/vclunohelper.hxx>
+ #include <vcl/window.hxx>
+ #include <tools/debug.hxx>
+#include <macroloader.hxx>
+ 
+ using namespace ::com::sun::star;
+ 
+@@ -159,6 +161,19 @@ sal_Bool SAL_CALL IFrameObject::load(
+ {
+     if ( SvtMiscOptions().IsPluginsEnabled() )
+     {
+        util::URL aTargetURL;
+        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+        xTrans->parseStrict( aTargetURL );
+
+        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+        {
+            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+            if (pDoc && !pDoc->AdjustMacroMode())
+                return false;
+        }
+
+         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+@@ -181,16 +196,12 @@ sal_Bool SAL_CALL IFrameObject::load(
+         if ( xFramesSupplier.is() )
+             mxFrame->setCreator( xFramesSupplier );
+ 
+-        util::URL aTargetURL;
+-        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+-        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+-        xTrans->parseStrict( aTargetURL );
+-
+         uno::Sequence < beans::PropertyValue > aProps(2);
+         aProps[0].Name = "PluginMode";
+         aProps[0].Value <<= sal_Int16(2);
+         aProps[1].Name = "ReadOnly";
+         aProps[1].Value <<= true;
+
+         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
+         if ( xDisp.is() )
+             xDisp->dispatch( aTargetURL, aProps );
+diff --git a/sfx2/source/inc/macroloader.hxx b/sfx2/source/inc/macroloader.hxx
+index 9e1dfba..b3e7a5e 100644
+--- a/sfx2/source/inc/macroloader.hxx
+++ b/sfx2/source/inc/macroloader.hxx
+@@ -82,6 +82,8 @@ public:
+     virtual void SAL_CALL addStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
+ 
+     virtual void SAL_CALL removeStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
+
+    static SfxObjectShell* GetObjectShell(const css::uno::Reference<css::frame::XFrame>& xFrame);
+ };
+ 
+ #endif
+diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
+index a0da671..eb70704 100644
+--- a/sw/source/filter/html/htmlplug.cxx
+++ b/sw/source/filter/html/htmlplug.cxx
+@@ -1087,7 +1087,12 @@ void SwHTMLParser::InsertFloatingFrame()
+                 bool bHasBorder = aFrameDesc.HasFrameBorder();
+                 Size aMargin = aFrameDesc.GetMargin();
+ 
+-                xSet->setPropertyValue("FrameURL", uno::makeAny( aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE ) ) );
+                OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+
+                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                    NotifyMacroEventRead();
+
+                xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
+                 xSet->setPropertyValue("FrameName", uno::makeAny( aName ) );
+ 
+                 if ( eScroll == ScrollingMode::Auto )
+diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
+index 788bec5..72a14b9 100644
+--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
+@@ -853,9 +853,14 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
+             uno::Reference < beans::XPropertySet > xSet( xObj->getComponent(), uno::UNO_QUERY );
+             if ( xSet.is() )
+             {
+                OUString sHRef = URIHelper::SmartRel2Abs(
+                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
+
+                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                    GetXMLImport().NotifyMacroEventRead();
+
+                 xSet->setPropertyValue("FrameURL",
+-                    makeAny( URIHelper::SmartRel2Abs(
+-                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef ) ) );
+                    makeAny( rHRef ) );
+ 
+                 xSet->setPropertyValue("FrameName",
+                     makeAny( rName ) );
+diff --git a/wizards/source/access2base/DoCmd.xba b/wizards/source/access2base/DoCmd.xba
+index 27b0d74..26755a8 100644
+--- a/wizards/source/access2base/DoCmd.xba
+++ b/wizards/source/access2base/DoCmd.xba
+@@ -2655,7 +2655,7 @@ Private Sub _ShellExecute(sCommand As String)
+ 
+ Dim oShell As Object
+ 	Set oShell = createUnoService(&quot;com.sun.star.system.SystemShellExecute&quot;)
+-	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
+	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
+ 
+ End Sub				&apos;	_ShellExecute			V0.8.5
+ 
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index 2e509f8..ae35f1e 100644
+--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
+@@ -87,6 +87,7 @@
+ #include <basegfx/polygon/b2dpolypolygon.hxx>
+ #include <basegfx/polygon/b2dpolypolygontools.hxx>
+ #include <basegfx/vector/b2dvector.hxx>
+#include <tools/urlobj.hxx>
+ #include <o3tl/safeint.hxx>
+ 
+ using namespace ::com::sun::star;
+@@ -3243,6 +3244,9 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+ 
+             if( !maHref.isEmpty() )
+             {
+                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
+                    GetImport().NotifyMacroEventRead();
+
+                 xProps->setPropertyValue("FrameURL", Any(maHref) );
+             }
+         }
+-- 
+2.37.3
+
--- a/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
+++ b/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
@ -0,0 +1,50 @@
+From 78fd31b17931e1217d3b11fcbd13a41d79d99055 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 11:41:05 +0200
+Subject: [PATCH] Convert attribute value to UTF-8 when passing it to libxml2
+
+Using toUtf8, requiring the OUString to actually contain well-formed data, but
+which is likely OK for this test-code--only function, and is also what similar
+dumpAsXml functions e.g. in editeng/source/items/textitem.cxx already use.
+
+This appears to have been broken ever since the code's introduction in
+553f10c71a2cc92f5f5890e24948f5277e3d2758 "add dumpAsXml() to more pool items",
+and it would typically only have written the leading zero or one
+(depending on the architecture's endianness) characters.  (I ran across it on
+big-endian s390x, where CppunitTest_sd_tiledrendering
+SdTiledRenderingTest::testTdf104405 failed because of
+
+> Entity: line 2: parser error : Input is not proper UTF-8, indicate encoding !
+> Bytes: 0xCF 0x22 0x2F 0x3E
+> ation=""/><SfxPoolItem whichId="4017" typeName="13SvxBulletItem" presentation="%
+>                                                                                ^
+
+apparently reported from within libxml2.)
+
+Change-Id: I4b116d3be84098bd8b8a13b6937da70a1ee02c7f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103236
+Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit fd9422febc384208558487bfe4a69ec89ab0ddca)
+---
+ svl/source/items/poolitem.cxx | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/svl/source/items/poolitem.cxx b/svl/source/items/poolitem.cxx
+index ec37b68d3417..ad07a0b60b4b 100644
+--- a/svl/source/items/poolitem.cxx
+++ b/svl/source/items/poolitem.cxx
+@@ -548,7 +548,8 @@ void SfxPoolItem::dumpAsXml(xmlTextWriterPtr pWriter) const
+     OUString rText;
+     IntlWrapper aIntlWrapper(SvtSysLocale().GetUILanguageTag());
+     if (GetPresentation( SfxItemPresentation::Complete, MapUnit::Map100thMM, MapUnit::Map100thMM, rText, aIntlWrapper))
+-        xmlTextWriterWriteAttribute(pWriter, BAD_CAST("presentation"), BAD_CAST(rText.getStr()));
+        xmlTextWriterWriteAttribute(
+            pWriter, BAD_CAST("presentation"), BAD_CAST(rText.toUtf8().getStr()));
+     xmlTextWriterEndElement(pWriter);
+ }
+ 
+-- 
+2.33.1
+
--- a/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
+++ b/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
@ -0,0 +1,65 @@
+From 41594786266265c1b7d5116ab85b38af0cd1fd59 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 12:01:35 +0200
+Subject: [PATCH] Correctly read PNG into bitmaps N32BitTcA... formats (where
+ alpha comes first)
+
+This appears to be a regression introduced with
+86ea64f216819696cd86d1926aff0a138ace2baf "Support for native 32bit Bitmap in VCL
+and SVP (cairo) backend".  It caused CppunitTest_vcl_png_test to fail on
+(big-endian) Linux s390x with
+
+> vcl/qa/cppunit/png/PngFilterTest.cxx:176:PngFilterTest::testPng
+> equality assertion failed
+> - Expected: c[ff000040]
+> - Actual  : c[0000ff40]
+
+where eFormat happens to be ScanlineFormat::N32BitTcArgb, vs.
+ScanlineFormat::N32BitTcBgra on e.g. Linux x86-64 (and which thus didn't notice
+the lack of support for N32BitTcA... formats where alpha goes first instead of
+last).
+
+Change-Id: Id6030468718f6ef831b42f2b5ad7ba2c4c46a805
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103240
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 0387077e6647d7a30fd36d4ec41dfc559afe45c3)
+---
+ vcl/source/filter/png/PngImageReader.cxx | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/vcl/source/filter/png/PngImageReader.cxx b/vcl/source/filter/png/PngImageReader.cxx
+index 958cae34eb46..6e9f3825face 100644
+--- a/vcl/source/filter/png/PngImageReader.cxx
+++ b/vcl/source/filter/png/PngImageReader.cxx
+@@ -188,6 +188,8 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
+                     for (auto& rRow : aRows)
+                         rRow.resize(aRowSizeBytes, 0);
+ 
+                    auto const alphaFirst = (eFormat == ScanlineFormat::N32BitTcAbgr
+                                             || eFormat == ScanlineFormat::N32BitTcArgb);
+                     for (int pass = 0; pass < nNumberOfPasses; pass++)
+                     {
+                         for (png_uint_32 y = 0; y < height; y++)
+@@ -199,10 +201,17 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
+                             for (size_t i = 0; i < aRowSizeBytes; i += 4)
+                             {
+                                 sal_Int8 alpha = pRow[i + 3];
+                                if (alphaFirst)
+                                {
+                                    pScanline[iColor++] = alpha;
+                                }
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 0], alpha);
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 1], alpha);
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 2], alpha);
+-                                pScanline[iColor++] = alpha;
+                                if (!alphaFirst)
+                                {
+                                    pScanline[iColor++] = alpha;
+                                }
+                             }
+                         }
+                     }
+-- 
+2.33.1
+
--- a/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
+++ b/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
@ -0,0 +1,116 @@
+From 96b088a62174a70441ebe959495756e9d86203a2 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Thu, 24 Sep 2020 14:51:16 +0200
+Subject: [PATCH] Fix endianness issues in OOX crypto routines
+
+...without which CppunitTest_sw_ooxmlencryption failed on (big-endian) s390x:
+
+* The 32-bit segment counter in AgileEngine::de-/encrypt apparently needs to be
+  stored in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
+  ultimately succeeded, whereas otherwise it failed).
+
+* The UTF-16 string in Standard2007Engine::calculateEncryptionKey apparently
+  needs to be in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
+  ultimately succeeded, whereas otherwise it failed).
+
+* The various 32-bit values in the EncryptionStandardHeader and
+  EncryptionVerifierAES data structures apparently need to be written out in LSB
+  format in Standard2007Engine::writeEncryptionInfo, given that they are always
+  read in LSB format in Standard2007Engine::readEncryptionInfo.
+
+Change-Id: I3a1efbfe324b1bbd539b88dc5d40bb44f9676ffa
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103315
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 646a69757b928aeaf6e0d0d41c4b30c02803a3a3)
+---
+ oox/source/crypto/AgileEngine.cxx        | 16 +++++++++-----
+ oox/source/crypto/Standard2007Engine.cxx | 28 +++++++++++++++++-------
+ 2 files changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/oox/source/crypto/AgileEngine.cxx b/oox/source/crypto/AgileEngine.cxx
+index 7c2a0e9c93d2..0fc972bf2ca5 100644
+--- a/oox/source/crypto/AgileEngine.cxx
+++ b/oox/source/crypto/AgileEngine.cxx
+@@ -457,9 +457,11 @@ bool AgileEngine::decrypt(BinaryXInputStream& aInputStream,
+ 
+     while ((inputLength = aInputStream.readMemory(inputBuffer.data(), inputBuffer.size())) > 0)
+     {
+-        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&segment);
+-        sal_uInt8* segmentEnd   = segmentBegin + sizeof(segment);
+-        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
+        auto p = saltWithBlockKey.begin() + saltSize;
+        p[0] = segment & 0xFF;
+        p[1] = (segment >> 8) & 0xFF;
+        p[2] = (segment >> 16) & 0xFF;
+        p[3] = segment >> 24;
+ 
+         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
+ 
+@@ -800,9 +802,11 @@ void AgileEngine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputS
+                         inputLength : oox::core::roundUp(inputLength, sal_uInt32(mInfo.blockSize));
+ 
+         // Update Key
+-        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&nSegment);
+-        sal_uInt8* segmentEnd   = segmentBegin + nSegmentByteSize;
+-        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
+        auto p = saltWithBlockKey.begin() + saltSize;
+        p[0] = nSegment & 0xFF;
+        p[1] = (nSegment >> 8) & 0xFF;
+        p[2] = (nSegment >> 16) & 0xFF;
+        p[3] = nSegment >> 24;
+ 
+         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
+ 
+diff --git a/oox/source/crypto/Standard2007Engine.cxx b/oox/source/crypto/Standard2007Engine.cxx
+index 38c4e03baf15..e96fc8f841f2 100644
+--- a/oox/source/crypto/Standard2007Engine.cxx
+++ b/oox/source/crypto/Standard2007Engine.cxx
+@@ -79,12 +79,12 @@ bool Standard2007Engine::calculateEncryptionKey(const OUString& rPassword)
+     std::vector<sal_uInt8> initialData(saltSize + passwordByteLength);
+     std::copy(saltArray, saltArray + saltSize, initialData.begin());
+ 
+-    const sal_uInt8* passwordByteArray = reinterpret_cast<const sal_uInt8*>(rPassword.getStr());
+-
+-    std::copy(
+-        passwordByteArray,
+-        passwordByteArray + passwordByteLength,
+-        initialData.begin() + saltSize);
+    auto p = initialData.begin() + saltSize;
+    for (sal_Int32 i = 0; i != rPassword.getLength(); ++i) {
+        auto c = rPassword[i];
+        *p++ = c & 0xFF;
+        *p++ = c >> 8;
+    }
+ 
+     // use "hash" vector for result of sha1 hashing
+     // calculate SHA1 hash of initialData
+@@ -223,11 +223,23 @@ void Standard2007Engine::writeEncryptionInfo(BinaryXOutputStream& rStream)
+     sal_uInt32 headerSize = encryptionHeaderSize + cspNameSize;
+     rStream.WriteUInt32(headerSize);
+ 
+-    rStream.writeMemory(&mInfo.header, encryptionHeaderSize);
+    rStream.WriteUInt32(mInfo.header.flags);
+    rStream.WriteUInt32(mInfo.header.sizeExtra);
+    rStream.WriteUInt32(mInfo.header.algId);
+    rStream.WriteUInt32(mInfo.header.algIdHash);
+    rStream.WriteUInt32(mInfo.header.keyBits);
+    rStream.WriteUInt32(mInfo.header.providedType);
+    rStream.WriteUInt32(mInfo.header.reserved1);
+    rStream.WriteUInt32(mInfo.header.reserved2);
+     rStream.writeUnicodeArray(lclCspName);
+     rStream.WriteUInt16(0);
+ 
+-    rStream.writeMemory(&mInfo.verifier, sizeof(msfilter::EncryptionVerifierAES));
+    rStream.WriteUInt32(mInfo.verifier.saltSize);
+    rStream.writeMemory(&mInfo.verifier.salt, sizeof mInfo.verifier.salt);
+    rStream.writeMemory(&mInfo.verifier.encryptedVerifier, sizeof mInfo.verifier.encryptedVerifier);
+    rStream.WriteUInt32(mInfo.verifier.encryptedVerifierHashSize);
+    rStream.writeMemory(
+        &mInfo.verifier.encryptedVerifierHash, sizeof mInfo.verifier.encryptedVerifierHash);
+ }
+ 
+ void Standard2007Engine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputStream,
+-- 
+2.33.1
+
--- a/SOURCES/0001-Flatpak-Add-app-bin-libreoffice-app-libreoffice-prog.patch
+++ b/SOURCES/0001-Flatpak-Add-app-bin-libreoffice-app-libreoffice-prog.patch
@ -0,0 +1,64 @@
+From acca5c87e73255db350a02d13bf34a62efaf9c93 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Tue, 21 Apr 2020 14:07:24 +0200
+Subject: [PATCH] Flatpak: Add /app/bin/libreoffice ->
+ /app/libreoffice/program/soffice symlink
+
+Which removes the need to rewrite the
+
+  Exec=${UNIXBASISROOTNAME}
+
+lines from sysui/desktop/menus/*.desktop, and helps to harmonize the plain
+Flatpak build with the one done from Fedora RPMs (see
+<https://src.fedoraproject.org/flatpaks/libreoffice>).
+
+(Also change the manifest command from an absolute path to a filename relative
+to PATH.  It is not clear to me which one would be better or more conventional,
+but at least <https://docs.flatpak.org/en/latest/manifests.html> also uses just
+a filename in its example.)
+
+Change-Id: I69c380b84503bf3d85801093fb92567852ceb00b
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/92837
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+---
+ solenv/bin/assemble-flatpak.sh | 4 ++--
+ solenv/flatpak-manifest.in     | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/solenv/bin/assemble-flatpak.sh b/solenv/bin/assemble-flatpak.sh
+index b4bce2d4d172..0738fcd59ad2 100755
+--- a/solenv/bin/assemble-flatpak.sh
+++ b/solenv/bin/assemble-flatpak.sh
+@@ -14,13 +14,13 @@
+ set -e
+ 
+ cp -r "${PREFIXDIR?}"/lib/libreoffice /app/
+ln -s /app/libreoffice/program/soffice /app/bin/libreoffice
+ 
+ ## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
+ mkdir -p /app/share/applications
+ for i in "${PREFIXDIR?}"/share/applications/libreoffice-*.desktop
+ do
+- sed -e 's,^Exec=libreoffice,Exec=/app/libreoffice/program/soffice,' \
+-  -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
+ sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
+   >/app/share/applications/org.libreoffice.LibreOffice."${i#"${PREFIXDIR?}"/share/applications/libreoffice-}"
+ done
+ mv /app/share/applications/org.libreoffice.LibreOffice.startcenter.desktop \
+diff --git a/solenv/flatpak-manifest.in b/solenv/flatpak-manifest.in
+index 9f64a142dd68..754b6b6dbbe1 100644
+--- a/solenv/flatpak-manifest.in
+++ b/solenv/flatpak-manifest.in
+@@ -6,7 +6,7 @@
+     "sdk-extensions": [
+         "org.freedesktop.Sdk.Extension.openjdk11"
+     ],
+-    "command": "/app/libreoffice/program/soffice",
+    "command": "libreoffice",
+     "modules": [
+         {
+             "name": "openjdk",
+-- 
+2.26.0
+
--- a/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
+++ b/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
@ -0,0 +1,59 @@
+From 9f393ee10ae198063bbe3b71c2c87262e7880a34 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 11:53:11 +0200
+Subject: [PATCH] Read MOSDocumentLockFile UTF-16 string data with same
+ endianness
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+...as MSODocumentLockFile::WriteEntryToStream has written it to (i.e.,
+always as UTF-16LE, assuming that is actually the right format to use).  The
+discrepancy between writing and reading the string data appears to be present
+ever since the code's introduction in 5db1e20b8b0942dac2d50f3cd34532bb61147020
+"Introduce new lockfile handler for MSO like lockfiles".
+
+This caused CppunitTest_svl_lockfiles to fail on (big-endian) s390x Linux with
+
+> svl/qa/unit/lockfiles/test_lockfiles.cxx:578:(anonymous namespace)::LockfileTest::testWordLockFileRT
+> equality assertion failed
+> - Expected: LockFile Test
+> - Actual  : 䰀漀挀欀䘀椀氀攀 吀攀猀琀
+
+etc.
+
+Change-Id: I97267aa14a3a926e7fd7bb1d2ce7d2de05d52a64
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103238
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 1b9fa11a0869246fe0433b79aab30dd216cf92b6)
+---
+ svl/source/misc/msodocumentlockfile.cxx | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/svl/source/misc/msodocumentlockfile.cxx b/svl/source/misc/msodocumentlockfile.cxx
+index 9650db03999f..0c857ffb53ec 100644
+--- a/svl/source/misc/msodocumentlockfile.cxx
+++ b/svl/source/misc/msodocumentlockfile.cxx
+@@ -228,8 +228,16 @@ LockFileEntry MSODocumentLockFile::GetLockData()
+                 nUTF16Len = *++pBuf; // use Excel/PowerPoint position
+ 
+             if (nUTF16Len > 0 && nUTF16Len <= 52) // skip wrong format
+-                aResult[LockFileComponent::OOOUSERNAME]
+-                    = OUString(reinterpret_cast<const sal_Unicode*>(pBuf + 2), nUTF16Len);
+            {
+                OUStringBuffer str(nUTF16Len);
+                sal_uInt8 const* p = reinterpret_cast<sal_uInt8 const*>(pBuf + 2);
+                for (int i = 0; i != nUTF16Len; ++i)
+                {
+                    str.append(sal_Unicode(p[0] | (sal_uInt32(p[1]) << 8)));
+                    p += 2;
+                }
+                aResult[LockFileComponent::OOOUSERNAME] = str.makeStringAndClear();
+            }
+         }
+     }
+     return aResult;
+-- 
+2.33.1
+
--- a/SOURCES/0001-Related-tdf-127782-resize-the-print-dialog-to-its-op.patch
+++ b/SOURCES/0001-Related-tdf-127782-resize-the-print-dialog-to-its-op.patch
--- a/SOURCES/0001-Resolves-rhbz-1432468-disable-opencl-by-default.patch
+++ b/SOURCES/0001-Resolves-rhbz-1432468-disable-opencl-by-default.patch
@ -0,0 +1,26 @@
+From b54cfe9d3d22fdd40f7015bd343df8620c983779 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 27 Mar 2017 11:47:01 +0100
+Subject: [PATCH] Resolves: rhbz#1432468 disable opencl by default
+
+Change-Id: Ie037fcabdd219f195425979dd721501fb5527573
+---
+ officecfg/registry/schema/org/openoffice/Office/Common.xcs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index 946bd32..284d694 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -5670,7 +5670,7 @@
+           <desc>Determines whether OpenCL can be used, when available, to speed up
+           some operations.</desc>
+         </info>
+-        <value>true</value>
+        <value>false</value>
+       </prop>
+       <prop oor:name="OpenCLBlackList" oor:type="oor:string-list" oor:nillable="false">
+         <!-- UIHints: Tools - Options General OpenCL -->
+-- 
+2.9.3
+
--- a/SOURCES/0001-Resolves-rhbz-1893846-if-last-close-had-insert-index.patch
+++ b/SOURCES/0001-Resolves-rhbz-1893846-if-last-close-had-insert-index.patch
@ -0,0 +1,30 @@
+From d59960d5de3f07726594d980152a3bfeb58bace9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 2 Nov 2020 19:27:04 +0000
+Subject: [PATCH 1/8] Resolves: rhbz#1893846 if last close had insert, index
+ dialog open
+
+when starting a new writer document
+
+Change-Id: I83131c01aa53208a321abade48d48a6f7965d0ff
+---
+ sw/source/ui/index/swuiidxmrk.cxx | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sw/source/ui/index/swuiidxmrk.cxx b/sw/source/ui/index/swuiidxmrk.cxx
+index 33a0eab8cd69..5eca069b963b 100644
+--- a/sw/source/ui/index/swuiidxmrk.cxx
+++ b/sw/source/ui/index/swuiidxmrk.cxx
+@@ -955,7 +955,8 @@ SwIndexMarkFloatDlg::SwIndexMarkFloatDlg(SfxBindings* _pBindings,
+         "modules/swriter/ui/indexentry.ui", "IndexEntryDialog")
+     , m_aContent(m_xDialog, *m_xBuilder, bNew, *::GetActiveWrtShell())
+ {
+-    m_aContent.ReInitDlg(*::GetActiveWrtShell());
+    if (SwWrtShell* pSh = ::GetActiveWrtShell())
+        m_aContent.ReInitDlg(*pSh);
+     Initialize(pInfo);
+ }
+ 
+-- 
+2.28.0
+
--- a/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
+++ b/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
@ -0,0 +1,72 @@
+From 5c705fbd9e4d231fed87b7e8ac06d8b7d4c6891f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 12 Aug 2021 12:55:30 +0100
+Subject: [PATCH] Resolves: tdf#132739 two style tags where there should be
+ just one
+
+Change-Id: Id9c8c8cc8c5ffdd21ba79ff39a6279cf2ddc8025
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120360
+Tested-by: Jenkins
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+---
+ sw/source/filter/html/css1atr.cxx  | 4 +++-
+ sw/source/filter/html/htmltabw.cxx | 9 ++++++---
+ sw/source/filter/html/wrthtml.hxx  | 2 +-
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sw/source/filter/html/css1atr.cxx b/sw/source/filter/html/css1atr.cxx
+index 7b1a5cc19be3..c401d95a788f 100644
+--- a/sw/source/filter/html/css1atr.cxx
+++ b/sw/source/filter/html/css1atr.cxx
+@@ -2113,10 +2113,12 @@ void SwHTMLWriter::OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameF
+         Strm().WriteChar( '\"' );
+ }
+ 
+-void SwHTMLWriter::OutCSS1_TableCellBorderHack(SwFrameFormat const& rFrameFormat)
+void SwHTMLWriter::OutCSS1_TableCellBordersAndBG(SwFrameFormat const& rFrameFormat, const SvxBrushItem *pBrushItem)
+ {
+     SwCSS1OutMode const aMode( *this,
+         CSS1_OUTMODE_STYLE_OPT_ON|CSS1_OUTMODE_ENCODE|CSS1_OUTMODE_TABLEBOX, nullptr );
+    if (pBrushItem)
+        OutCSS1_SvxBrush(*this, *pBrushItem, Css1Background::Table, nullptr);
+     OutCSS1_SvxBox(*this, rFrameFormat.GetBox());
+     if (!m_bFirstCSS1Property)
+     {
+diff --git a/sw/source/filter/html/htmltabw.cxx b/sw/source/filter/html/htmltabw.cxx
+index 4c83319747b7..63812a9b3ef6 100644
+--- a/sw/source/filter/html/htmltabw.cxx
+++ b/sw/source/filter/html/htmltabw.cxx
+@@ -424,11 +424,14 @@ void SwHTMLWrtTable::OutTableCell( SwHTMLWriter& rWrt,
+             // Avoid non-CSS version in the ReqIF case.
+             rWrt.OutBackground( pBrushItem, false );
+ 
+-        if( rWrt.m_bCfgOutStyles )
+-            OutCSS1_TableBGStyleOpt( rWrt, *pBrushItem );
+        if (!rWrt.m_bCfgOutStyles)
+            pBrushItem = nullptr;
+     }
+ 
+-    rWrt.OutCSS1_TableCellBorderHack(*pBox->GetFrameFormat());
+    // tdf#132739 with rWrt.m_bCfgOutStyles of true bundle the brush item css
+    // properties into the same "style" tag as the borders so there is only one
+    // style tag
+    rWrt.OutCSS1_TableCellBordersAndBG(*pBox->GetFrameFormat(), pBrushItem);
+ 
+     sal_uInt32 nNumFormat = 0;
+     double nValue = 0.0;
+diff --git a/sw/source/filter/html/wrthtml.hxx b/sw/source/filter/html/wrthtml.hxx
+index ab282ba652ff..f82325ee50ae 100644
+--- a/sw/source/filter/html/wrthtml.hxx
+++ b/sw/source/filter/html/wrthtml.hxx
+@@ -484,7 +484,7 @@ public:
+     void writeFrameFormatOptions(HtmlWriter& aHtml, const SwFrameFormat& rFrameFormat, const OUString& rAltText, HtmlFrmOpts nFrameOpts);
+ 
+     void OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameFormat );
+-    void OutCSS1_TableCellBorderHack(const SwFrameFormat& rFrameFormat);
+    void OutCSS1_TableCellBordersAndBG(const SwFrameFormat& rFrameFormat, const SvxBrushItem *pBrushItem);
+     void OutCSS1_SectionFormatOptions( const SwFrameFormat& rFrameFormat, const SwFormatCol *pCol );
+     void OutCSS1_FrameFormatOptions( const SwFrameFormat& rFrameFormat, HtmlFrmOpts nFrameOpts,
+                                      const SdrObject *pSdrObj=nullptr,
+-- 
+2.31.1
+
--- a/SOURCES/0001-Restructure-solenv-bin-assemble-flatpak.sh.patch
+++ b/SOURCES/0001-Restructure-solenv-bin-assemble-flatpak.sh.patch
@ -0,0 +1,340 @@
+From 54f42e1b75dd795f9d53dce181397f114eeae21b Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Tue, 28 Apr 2020 16:43:31 +0200
+Subject: [PATCH] Restructure solenv/bin/assemble-flatpak.sh
+
+...so that parts of it can be reused by the Flatpak build done from Fedora RPMs
+(see <https://src.fedoraproject.org/flatpaks/libreoffice>).  The reused parts
+are split out into solenv/bin/assemble-flatpak-*.sh files.
+
+(I can't remember any specific reason why I added the <releases> section to the
+Flathub org.libreoffice.LibreOffice.appdata.xml; maybe just because the file
+format allows for it and it appeared easy to generate the section when writing
+the file.  For the Fedora LO RPMs, none of the existing appdata.xml files
+contained such a section, and generating one for the Fedora Flatpak case would
+require obtaining values for those LIBO_VERSION_* variables, so I just added a
+switch to solenv/bin/assemble-flatpak-appdata-step1.sh allowing not to write
+that section at all.  Splitting solenv/bin/assemble-flatpak-appdata.sh in two
+steps is necessary because the Fedora Flatpak case wants to replace the
+screenshots in the first part of the generated
+org.libreoffice.LibreOffice.appdata.xml, but not in the appended original
+appdata.xml files, so needs to hook in between those two steps.)
+
+Change-Id: Ic527f3d88ccbee85e86dad3569b8e73776adf273
+---
+ solenv/bin/assemble-flatpak-appdata-step1.sh |  96 +++++++++++++++++
+ solenv/bin/assemble-flatpak-appdata-step2.sh |  26 +++++
+ solenv/bin/assemble-flatpak-desktop.sh       |  42 ++++++++
+ solenv/bin/assemble-flatpak.sh               | 102 +------------------
+ 4 files changed, 169 insertions(+), 97 deletions(-)
+ create mode 100755 solenv/bin/assemble-flatpak-appdata-step1.sh
+ create mode 100755 solenv/bin/assemble-flatpak-appdata-step2.sh
+ create mode 100755 solenv/bin/assemble-flatpak-desktop.sh
+
+diff --git a/solenv/bin/assemble-flatpak-appdata-step1.sh b/solenv/bin/assemble-flatpak-appdata-step1.sh
+new file mode 100755
+index 000000000000..4658dd45d018
+--- /dev/null
+++ b/solenv/bin/assemble-flatpak-appdata-step1.sh
+@@ -0,0 +1,96 @@
+#! /bin/bash
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
+# Flatpak from a Fedora libreoffice.spec file.
+#
+# Arguments:
+# $1  pathname, ending in a slash, of the directory into which to put the target
+#     org.libreoffice.LibreOffice.appdata.xml file
+# $2  "1" if a <releases> section shall be included in the target
+#     org.libreoffice.LibreOffice.appdata.xml file, "0" if not
+
+set -e
+
+## org.libreoffice.LibreOffice.appdata.xml is manually derived from the various
+## inst/share/appdata/libreoffice-*.appdata.xml (at least recent GNOME Software
+## doesn't show more than five screenshots anyway, so restrict to one each from
+## the five libreoffice-*.appdata.xml: Writer, Calc, Impress, Draw, Base):
+cat <<\EOF >"${1?}"org.libreoffice.LibreOffice.appdata.xml
+<?xml version="1.0" encoding="UTF-8"?>
+<component type="desktop">
+ <id>org.libreoffice.LibreOffice.desktop</id>
+ <metadata_license>CC0-1.0</metadata_license>
+ <project_license>MPL-2.0</project_license>
+ <name>LibreOffice</name>
+ <summary>The LibreOffice productivity suite</summary>
+ <description>
+  <p>LibreOffice is a powerful office suite.  Its clean interface and
+  feature-rich tools help you unleash your creativity and enhance your
+  productivity.  LibreOffice includes several applications that make it the most
+  powerful Free and Open Source office suite on the market: Writer (word
+  processing), Calc (spreadsheets), Impress (presentations), Draw (vector
+  graphics and flowcharts), Base (databases), and Math (formula editing).</p>
+  <p>LibreOffice supports opening and saving into a wide variety of formats, so
+  you can easily share documents with users of other popular office suites
+  without worrying about compatibility.</p>
+ </description>
+ <url type="homepage">http://www.libreoffice.org/discover/libreoffice/</url>
+ <url type="bugtracker">https://bugs.documentfoundation.org/</url>
+ <url type="donation">https://donate.libreoffice.org/</url>
+ <url type="faq">https://wiki.documentfoundation.org/Faq</url>
+ <url type="help">http://www.libreoffice.org/get-help/documentation/</url>
+ <url type="translate">https://wiki.documentfoundation.org/Translating_LibreOffice</url>
+ <screenshots>
+  <screenshot type="default">
+   <image>https://hub.libreoffice.org/screenshots/writer-01.png</image>
+   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+  </screenshot>
+  <screenshot>
+   <image>https://hub.libreoffice.org/screenshots/calc-02.png</image>
+   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+  </screenshot>
+  <screenshot>
+   <image>https://hub.libreoffice.org/screenshots/impress-01.png</image>
+   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+  </screenshot>
+  <screenshot>
+   <image>https://hub.libreoffice.org/screenshots/draw-02.png</image>
+   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+  </screenshot>
+  <screenshot>
+   <image>https://hub.libreoffice.org/screenshots/base-02.png</image>
+   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+  </screenshot>
+ </screenshots>
+ <developer_name>The Document Foundation</developer_name>
+ <update_contact>libreoffice_at_lists.freedesktop.org</update_contact>
+ <kudos>
+  <kudo>HiDpiIcon</kudo>
+  <kudo>HighContrast</kudo>
+  <kudo>ModernToolkit</kudo>
+  <kudo>UserDocs</kudo>
+ </kudos>
+ <content_rating type="oars-1.0"/>
+EOF
+
+if [ "${2?}" = 1 ]
+then
+ cat <<EOF >>"${1?}"org.libreoffice.LibreOffice.appdata.xml
+ <releases>
+  <release
+    version="${LIBO_VERSION_MAJOR?}.${LIBO_VERSION_MINOR?}.${LIBO_VERSION_MICRO?}.${LIBO_VERSION_PATCH?}"
+    date="$(date +%Y-%m-%d)"/>
+ </releases>
+EOF
+fi
+
+cat <<\EOF >>"${1?}"org.libreoffice.LibreOffice.appdata.xml
+</component>
+EOF
+diff --git a/solenv/bin/assemble-flatpak-appdata-step2.sh b/solenv/bin/assemble-flatpak-appdata-step2.sh
+new file mode 100755
+index 000000000000..4f06e6b19148
+--- /dev/null
+++ b/solenv/bin/assemble-flatpak-appdata-step2.sh
+@@ -0,0 +1,26 @@
+#! /bin/bash
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
+# Flatpak from a Fedora libreoffice.spec file.
+#
+# Arguments:
+# $1  pathname, ending in a slash, of the directory containing the source libreoffice-*.appdata.xml
+#     files
+# $2  pathname, ending in a slash, of the directory containing the target
+#     org.libreoffice.LibreOffice.appdata.xml file
+
+set -e
+
+# append the appdata for the different components
+for i in "${1?}"libreoffice-*.appdata.xml
+do
+  sed "1 d; s/<id>libreoffice-/<id>org.libreoffice.LibreOffice./" "$i" \
+    >>"${2?}"org.libreoffice.LibreOffice.appdata.xml
+done
+diff --git a/solenv/bin/assemble-flatpak-desktop.sh b/solenv/bin/assemble-flatpak-desktop.sh
+new file mode 100755
+index 000000000000..6d06de4fbbbe
+--- /dev/null
+++ b/solenv/bin/assemble-flatpak-desktop.sh
+@@ -0,0 +1,42 @@
+#! /bin/bash
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
+# Flatpak from a Fedora libreoffice.spec file.
+#
+# Arguments:
+# $1  pathname, ending in a slash, of the directory containing the source libreoffice-*.desktop
+#     files
+# $2  pathname, ending in a slash, of the directory into which to put the target
+#     org.libreoffice.LibreOffice.*.desktop files
+
+set -e
+
+## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
+for i in "${1?}"libreoffice-*.desktop
+do
+ sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
+  >"${2?}"org.libreoffice.LibreOffice."${i#"${1?}"libreoffice-}"
+done
+mv "${2?}"org.libreoffice.LibreOffice.startcenter.desktop "${2?}"org.libreoffice.LibreOffice.desktop
+
+# Flatpak .desktop exports take precedence over system ones due to
+# the order of XDG_DATA_DIRS - re-associating text/plain seems a bit much
+sed -i "s/text\/plain;//" "${2?}"org.libreoffice.LibreOffice.writer.desktop
+
+desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-startcenter \
+ --set-key=X-Flatpak-RenamedFrom --set-value='libreoffice-startcenter.desktop;' \
+ "${2?}"org.libreoffice.LibreOffice.desktop
+for i in base calc draw impress math writer xsltfilter
+do
+ desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-"$i" \
+  --set-key=X-Flatpak-RenamedFrom \
+  --set-value="libreoffice-$i.desktop;org.libreoffice.LibreOffice-$i.desktop;" \
+  "${2?}"org.libreoffice.LibreOffice."$i".desktop
+done
+diff --git a/solenv/bin/assemble-flatpak.sh b/solenv/bin/assemble-flatpak.sh
+index 0738fcd59ad2..8ca5bcf08c41 100755
+--- a/solenv/bin/assemble-flatpak.sh
+++ b/solenv/bin/assemble-flatpak.sh
+@@ -16,30 +16,9 @@ set -e
+ cp -r "${PREFIXDIR?}"/lib/libreoffice /app/
+ ln -s /app/libreoffice/program/soffice /app/bin/libreoffice
+ 
+-## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
+ mkdir -p /app/share/applications
+-for i in "${PREFIXDIR?}"/share/applications/libreoffice-*.desktop
+-do
+- sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
+-  >/app/share/applications/org.libreoffice.LibreOffice."${i#"${PREFIXDIR?}"/share/applications/libreoffice-}"
+-done
+-mv /app/share/applications/org.libreoffice.LibreOffice.startcenter.desktop \
+- /app/share/applications/org.libreoffice.LibreOffice.desktop
+-
+-# Flatpak .desktop exports take precedence over system ones due to
+-# the order of XDG_DATA_DIRS - re-associating text/plain seems a bit much
+-sed -i "s/text\/plain;//" /app/share/applications/org.libreoffice.LibreOffice.writer.desktop
+-
+-desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-startcenter \
+- --set-key=X-Flatpak-RenamedFrom --set-value='libreoffice-startcenter.desktop;' \
+- /app/share/applications/org.libreoffice.LibreOffice.desktop
+-for i in base calc draw impress math writer xsltfilter
+-do
+- desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-"$i" \
+-  --set-key=X-Flatpak-RenamedFrom \
+-  --set-value="libreoffice-$i.desktop;org.libreoffice.LibreOffice-$i.desktop;" \
+-  /app/share/applications/org.libreoffice.LibreOffice."$i".desktop
+-done
+"${SRCDIR?}"/solenv/bin/assemble-flatpak-desktop.sh "${PREFIXDIR?}"/share/applications/ \
+ /app/share/applications/
+ 
+ ## icons/hicolor/*/apps/libreoffice-* ->
+ ## icons/hicolor/*/apps/org.libreoffice.LibreOffice-*:
+@@ -82,81 +61,10 @@ do
+   ln -rs /app/share/runtime/locale/"${lang}"/registry/"${basename}".xcd "${i}"
+ done
+ 
+-## org.libreoffice.LibreOffice.appdata.xml is manually derived from the various
+-## inst/share/appdata/libreoffice-*.appdata.xml (at least recent GNOME Software
+-## doesn't show more than five screenshots anyway, so restrict to one each from
+-## the five libreoffice-*.appdata.xml: Writer, Calc, Impress, Draw, Base):
+ mkdir -p /app/share/appdata
+-cat <<EOF >/app/share/appdata/org.libreoffice.LibreOffice.appdata.xml
+-<?xml version="1.0" encoding="UTF-8"?>
+-<component type="desktop">
+- <id>org.libreoffice.LibreOffice.desktop</id>
+- <metadata_license>CC0-1.0</metadata_license>
+- <project_license>MPL-2.0</project_license>
+- <name>LibreOffice</name>
+- <summary>The LibreOffice productivity suite</summary>
+- <description>
+-  <p>LibreOffice is a powerful office suite.  Its clean interface and
+-  feature-rich tools help you unleash your creativity and enhance your
+-  productivity.  LibreOffice includes several applications that make it the most
+-  powerful Free and Open Source office suite on the market: Writer (word
+-  processing), Calc (spreadsheets), Impress (presentations), Draw (vector
+-  graphics and flowcharts), Base (databases), and Math (formula editing).</p>
+-  <p>LibreOffice supports opening and saving into a wide variety of formats, so
+-  you can easily share documents with users of other popular office suites
+-  without worrying about compatibility.</p>
+- </description>
+- <url type="homepage">http://www.libreoffice.org/discover/libreoffice/</url>
+- <url type="bugtracker">https://bugs.documentfoundation.org/</url>
+- <url type="donation">https://donate.libreoffice.org/</url>
+- <url type="faq">https://wiki.documentfoundation.org/Faq</url>
+- <url type="help">http://www.libreoffice.org/get-help/documentation/</url>
+- <url type="translate">https://wiki.documentfoundation.org/Translating_LibreOffice</url>
+- <screenshots>
+-  <screenshot type="default">
+-   <image>https://hub.libreoffice.org/screenshots/writer-01.png</image>
+-   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+-  </screenshot>
+-  <screenshot>
+-   <image>https://hub.libreoffice.org/screenshots/calc-02.png</image>
+-   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+-  </screenshot>
+-  <screenshot>
+-   <image>https://hub.libreoffice.org/screenshots/impress-01.png</image>
+-   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+-  </screenshot>
+-  <screenshot>
+-   <image>https://hub.libreoffice.org/screenshots/draw-02.png</image>
+-   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+-  </screenshot>
+-  <screenshot>
+-   <image>https://hub.libreoffice.org/screenshots/base-02.png</image>
+-   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
+-  </screenshot>
+- </screenshots>
+- <developer_name>The Document Foundation</developer_name>
+- <update_contact>libreoffice_at_lists.freedesktop.org</update_contact>
+- <kudos>
+-  <kudo>HiDpiIcon</kudo>
+-  <kudo>HighContrast</kudo>
+-  <kudo>ModernToolkit</kudo>
+-  <kudo>UserDocs</kudo>
+- </kudos>
+- <content_rating type="oars-1.0"/>
+- <releases>
+-  <release
+-    version="${LIBO_VERSION_MAJOR?}.${LIBO_VERSION_MINOR?}.${LIBO_VERSION_MICRO?}.${LIBO_VERSION_PATCH?}"
+-    date="$(date +%Y-%m-%d)"/>
+- </releases>
+-</component>
+-EOF
+-
+-# append the appdata for the different components
+-for i in "${PREFIXDIR?}"/share/appdata/libreoffice-*.appdata.xml
+-do
+-  sed "1 d; s/<id>libreoffice-/<id>org.libreoffice.LibreOffice./" "$i" \
+-    >>/app/share/appdata/org.libreoffice.LibreOffice.appdata.xml
+-done
+"${SRCDIR?}"/solenv/bin/assemble-flatpak-appdata-step1.sh /app/share/appdata/ 1
+"${SRCDIR?}"/solenv/bin/assemble-flatpak-appdata-step2.sh "${PREFIXDIR?}"/share/appdata/ \
+ /app/share/appdata/
+ 
+ ## see <https://github.com/flatpak/flatpak/blob/master/app/
+ ## flatpak-builtins-build-finish.c> for further places where build-finish would
+-- 
+2.26.2
+
--- a/SOURCES/0001-Revert-tdf-69060-lock-refreshing-font-data-when-load.patch
+++ b/SOURCES/0001-Revert-tdf-69060-lock-refreshing-font-data-when-load.patch
@ -0,0 +1,150 @@
+From d7ed56975a828eac321959e4510ee14560847b1f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 28 Oct 2020 14:25:11 +0000
+Subject: [PATCH] Revert "tdf#69060: lock refreshing font data when loading a
+ document"
+
+This reverts commit 98d71c4e0847797a4ba9229a8e6d832a8a3d5e0f.
+---
+ include/vcl/outdev.hxx      |  3 ---
+ include/vcl/svapp.hxx       | 11 -----------
+ sfx2/source/doc/objstor.cxx |  4 ----
+ vcl/inc/svdata.hxx          |  3 ---
+ vcl/source/app/svapp.cxx    |  5 -----
+ vcl/source/outdev/font.cxx  | 32 +-------------------------------
+ 6 files changed, 1 insertion(+), 57 deletions(-)
+
+diff --git a/include/vcl/outdev.hxx b/include/vcl/outdev.hxx
+index cd3c84d13305..55b466b42464 100644
+--- a/include/vcl/outdev.hxx
+++ b/include/vcl/outdev.hxx
+@@ -1278,9 +1278,6 @@ public:
+     //If bNewFontLists is true then drop and refetch lists of system fonts
+     SAL_DLLPRIVATE static void  ImplUpdateAllFontData( bool bNewFontLists );
+ 
+-    // Lock font updates for all output devices
+-    static void LockFontUpdates(bool bLock);
+-
+ protected:
+     SAL_DLLPRIVATE const LogicalFontInstance* GetFontInstance() const;
+     SAL_DLLPRIVATE long GetEmphasisAscent() const { return mnEmphasisAscent; }
+diff --git a/include/vcl/svapp.hxx b/include/vcl/svapp.hxx
+index 16b8015b923a..4f7b9d6def31 100644
+--- a/include/vcl/svapp.hxx
+++ b/include/vcl/svapp.hxx
+@@ -1326,17 +1326,6 @@ public:
+ 
+     ///@}
+ 
+-    /** Lock font updates for all output devices
+-
+-     @remark When performing operations that might involve multiple registration of fonts, such as
+-        opening/closing documents with multiple embedded fonts, then each font addition/removal
+-        might cause an event that initiates a rebuild of each OutputDevice's font lists.
+-
+-        Locking font updates disables processing such events, and unlocking causes a single such
+-        processing for all OutputDevices.
+-    */
+-    static void LockFontUpdates(bool bLock);
+-
+     // For vclbootstrapprotector:
+     static void setDeInitHook(Link<LinkParamNone*,void> const & hook);
+ 
+diff --git a/sfx2/source/doc/objstor.cxx b/sfx2/source/doc/objstor.cxx
+index 6d7b3f99ee69..ac9f4242a1bc 100644
+--- a/sfx2/source/doc/objstor.cxx
+++ b/sfx2/source/doc/objstor.cxx
+@@ -582,10 +582,6 @@ bool SfxObjectShell::ImportFromGeneratedStream_Impl(
+ bool SfxObjectShell::DoLoad( SfxMedium *pMed )
+ {
+     ModifyBlocker_Impl aBlock( this );
+-    struct FontLockGuard {
+-        FontLockGuard() { Application::LockFontUpdates(true); }
+-        ~FontLockGuard() { Application::LockFontUpdates(false); }
+-    } aFontLockGuard;
+ 
+     pMedium = pMed;
+     pMedium->CanDisposeStorage_Impl( true );
+diff --git a/vcl/inc/svdata.hxx b/vcl/inc/svdata.hxx
+index e41ec23488b3..dc10f3102ede 100644
+--- a/vcl/inc/svdata.hxx
+++ b/vcl/inc/svdata.hxx
+@@ -338,9 +338,6 @@ struct ImplSVData
+     VclPtr<WorkWindow>      mpDefaultWin;                   // Default-Window
+     bool                    mbDeInit = false;               // Is VCL deinitializing
+     std::unique_ptr<SalSystem> mpSalSystem;                 // SalSystem interface
+-    int                     mnFontUpdatesLockCount = 0;     // avoid repeated font updates
+-    bool                    mbFontUpdatesPending = false;   // need to update font data after unlock
+-    bool                    mbFontUpdatesNewLists = false;  // generate new font lists
+     bool                    mbResLocaleSet = false;         // SV-Resource-Manager
+     std::locale             maResLocale;                    // Resource locale
+     ImplSchedulerContext    maSchedCtx;                     // indepen data for class Scheduler
+diff --git a/vcl/source/app/svapp.cxx b/vcl/source/app/svapp.cxx
+index c4c3be9699e3..de4eac9687fc 100644
+--- a/vcl/source/app/svapp.cxx
+++ b/vcl/source/app/svapp.cxx
+@@ -1036,11 +1036,6 @@ void Application::RemoveUserEvent( ImplSVEvent * nUserEvent )
+     }
+ }
+ 
+-void Application::LockFontUpdates(bool bLock)
+-{
+-    OutputDevice::LockFontUpdates(bLock);
+-}
+-
+ WorkWindow* Application::GetAppWindow()
+ {
+     return ImplGetSVData()->maWinData.mpAppWin;
+diff --git a/vcl/source/outdev/font.cxx b/vcl/source/outdev/font.cxx
+index 22c61063bd21..e1fd7d107e63 100644
+--- a/vcl/source/outdev/font.cxx
+++ b/vcl/source/outdev/font.cxx
+@@ -559,16 +559,7 @@ void OutputDevice::ImplClearAllFontData(bool bNewFontLists)
+ 
+ void OutputDevice::ImplRefreshAllFontData(bool bNewFontLists)
+ {
+-    auto svdata = ImplGetSVData();
+-    DBG_TESTSOLARMUTEX();
+-    if (!svdata->mnFontUpdatesLockCount)
+-        ImplUpdateFontDataForAllFrames(&OutputDevice::ImplRefreshFontData, bNewFontLists);
+-    else
+-    {
+-        svdata->mbFontUpdatesPending = true;
+-        if (bNewFontLists)
+-            svdata->mbFontUpdatesNewLists = true;
+-    }
+    ImplUpdateFontDataForAllFrames( &OutputDevice::ImplRefreshFontData, bNewFontLists );
+ }
+ 
+ void OutputDevice::ImplUpdateAllFontData(bool bNewFontLists)
+@@ -614,27 +605,6 @@ void OutputDevice::ImplUpdateFontDataForAllFrames( const FontUpdateHandler_t pHd
+     }
+ }
+ 
+-void OutputDevice::LockFontUpdates(bool bLock)
+-{
+-    auto svdata = ImplGetSVData();
+-    DBG_TESTSOLARMUTEX();
+-    if (bLock)
+-    {
+-        ++svdata->mnFontUpdatesLockCount;
+-    }
+-    else if (svdata->mnFontUpdatesLockCount > 0)
+-    {
+-        --svdata->mnFontUpdatesLockCount;
+-        if (!svdata->mnFontUpdatesLockCount && svdata->mbFontUpdatesPending)
+-        {
+-            ImplRefreshAllFontData(svdata->mbFontUpdatesNewLists);
+-
+-            svdata->mbFontUpdatesPending = false;
+-            svdata->mbFontUpdatesNewLists = false;
+-        }
+-    }
+-}
+-
+ void OutputDevice::BeginFontSubstitution()
+ {
+     ImplSVData* pSVData = ImplGetSVData();
+-- 
+2.26.2
+
--- a/SOURCES/0001-backports-to-ease-CVE-backporting.patch
+++ b/SOURCES/0001-backports-to-ease-CVE-backporting.patch
@ -0,0 +1,259 @@
+From c2cf13da3bbf756ef3f78251c40d45fc23c27f36 Mon Sep 17 00:00:00 2001
+From: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
+Date: Wed, 29 Apr 2020 07:42:24 +0200
+Subject: [PATCH 1/6] backports to ease CVE backporting
+
+Remove unnecessary if block
+
+And format code inside
+
+Change-Id: Ied0d98935134bf6f7bc8c929645ad5faac9affa3
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93116
+Tested-by: Jenkins
+Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
+(cherry picked from commit cf36fe5eb41910c26d58fb25e54ccf2e0ee01365)
+
+space out the namespace constant values
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/88938
+(cherry picked from commit 5352d45dd4a04f8f02cf7f6ad4169126d3b3586a)
+
+Change-Id: I30f54bfc1389e91b18e4fee8b83e1b297419899b
+---
+ include/xmloff/xmlnmspe.hxx                   |  16 +--
+ .../component/documentdigitalsignatures.cxx   | 130 +++++++++---------
+ .../source/helper/xmlsignaturehelper.cxx      |   1 +
+ 3 files changed, 75 insertions(+), 72 deletions(-)
+
+diff --git a/include/xmloff/xmlnmspe.hxx b/include/xmloff/xmlnmspe.hxx
+index a00628b6b999..b079053c38d3 100644
+--- a/include/xmloff/xmlnmspe.hxx
+++ b/include/xmloff/xmlnmspe.hxx
+@@ -69,7 +69,7 @@ XML_NAMESPACE( XML_NAMESPACE_VERSIONS_LIST,   37U )
+ 
+ // namespaces for odf extended formats
+ 
+-#define XML_NAMESPACE_EXT_BASE 38U
+#define XML_NAMESPACE_EXT_BASE 50U
+ #define XML_NAMESPACE_EXT( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_EXT_BASE+index);
+ 
+@@ -82,7 +82,7 @@ XML_NAMESPACE_EXT( XML_NAMESPACE_LO_EXT,           5U )
+ 
+ // namespaces for OOo formats
+ 
+-#define XML_NAMESPACE_OOO_BASE 44U
+#define XML_NAMESPACE_OOO_BASE 60U
+ #define XML_NAMESPACE_OOO( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_OOO_BASE+index);
+ 
+@@ -100,7 +100,7 @@ XML_NAMESPACE_OOO( XML_NAMESPACE_CONFIG_OOO,        10U )
+ XML_NAMESPACE_OOO( XML_NAMESPACE_FORM_OOO,          11U )
+ XML_NAMESPACE_OOO( XML_NAMESPACE_SCRIPT_OOO,        12U )
+ 
+-#define XML_NAMESPACE_COMPAT_BASE 57U
+#define XML_NAMESPACE_COMPAT_BASE 80U
+ #define XML_NAMESPACE_COMPAT( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_COMPAT_BASE+index);
+ 
+@@ -108,14 +108,14 @@ XML_NAMESPACE_COMPAT( XML_NAMESPACE_SVG_COMPAT,      0U )
+ XML_NAMESPACE_COMPAT( XML_NAMESPACE_FO_COMPAT,       1U )
+ XML_NAMESPACE_COMPAT( XML_NAMESPACE_SMIL_COMPAT,     2U )
+ 
+-#define XML_NAMESPACE_OASIS_BASE 60U
+#define XML_NAMESPACE_OASIS_BASE 90U
+ #define XML_NAMESPACE_OASIS( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_OASIS_BASE+index);
+ 
+ XML_NAMESPACE_OASIS( XML_NAMESPACE_DB_OASIS,         0U )
+ XML_NAMESPACE_OASIS( XML_NAMESPACE_REPORT_OASIS,     1U )
+ 
+-#define XML_OLD_NAMESPACE_BASE 62U
+#define XML_OLD_NAMESPACE_BASE 100U
+ #define XML_OLD_NAMESPACE( prefix, index ) \
+ const sal_uInt16 prefix = (XML_OLD_NAMESPACE_BASE+index);
+ 
+@@ -134,9 +134,9 @@ XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_CHART,         10U )
+ XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_SMIL,          11U )
+ 
+ // experimental namespaces
+-XML_NAMESPACE( XML_NAMESPACE_FIELD,           100U )
+-XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        103U )  // CSS Text Level 3
+-XML_NAMESPACE( XML_NAMESPACE_FORMX,           101U )  // form interop extensions
+XML_NAMESPACE( XML_NAMESPACE_FIELD,           120U )
+XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        123U )  // CSS Text Level 3
+XML_NAMESPACE( XML_NAMESPACE_FORMX,           121U )  // form interop extensions
+ 
+ 
+ #endif // INCLUDED_XMLOFF_XMLNMSPE_HXX
+diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+index dcfaad0af773..52cb938a8e0a 100644
+--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+@@ -500,85 +500,87 @@ DocumentDigitalSignatures::ImplVerifySignatures(
+     Sequence< css::security::DocumentSignatureInformation > aInfos(nInfos);
+     css::security::DocumentSignatureInformation* arInfos = aInfos.getArray();
+ 
+-    if ( nInfos )
+    for (int n = 0; n < nInfos; ++n)
+     {
+-        for( int n = 0; n < nInfos; ++n )
+-        {
+-            DocumentSignatureAlgorithm mode = DocumentSignatureHelper::getDocumentAlgorithm(
+-                m_sODFVersion, aSignInfos[n]);
+-            const std::vector< OUString > aElementsToBeVerified =
+-                DocumentSignatureHelper::CreateElementList(
+-                rxStorage, eMode, mode);
+        DocumentSignatureAlgorithm mode
+            = DocumentSignatureHelper::getDocumentAlgorithm(m_sODFVersion, aSignInfos[n]);
+        const std::vector<OUString> aElementsToBeVerified
+            = DocumentSignatureHelper::CreateElementList(rxStorage, eMode, mode);
+ 
+-            const SignatureInformation& rInfo = aSignInfos[n];
+-            css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
+        const SignatureInformation& rInfo = aSignInfos[n];
+        css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
+ 
+-            if (rInfo.ouGpgCertificate.isEmpty()) // X.509
+        if (rInfo.ouGpgCertificate.isEmpty()) // X.509
+        {
+            if (!rInfo.ouX509Certificate.isEmpty())
+                rSigInfo.Signer = xSecEnv->createCertificateFromAscii(rInfo.ouX509Certificate);
+            if (!rSigInfo.Signer.is())
+                rSigInfo.Signer = xSecEnv->getCertificate(
+                    rInfo.ouX509IssuerName,
+                    xmlsecurity::numericStringToBigInteger(rInfo.ouX509SerialNumber));
+
+            // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
+            // to find the parent certificate. It does not take into account that there can be several certificates
+            // with the same subject name.
+            try
+             {
+-                if (!rInfo.ouX509Certificate.isEmpty())
+-                    rSigInfo.Signer = xSecEnv->createCertificateFromAscii( rInfo.ouX509Certificate ) ;
+-                if (!rSigInfo.Signer.is())
+-                    rSigInfo.Signer = xSecEnv->getCertificate( rInfo.ouX509IssuerName,
+-                                                               xmlsecurity::numericStringToBigInteger( rInfo.ouX509SerialNumber ) );
+-
+-                // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
+-                // to find the parent certificate. It does not take into account that there can be several certificates
+-                // with the same subject name.
+-
+-                try {
+-                    rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(rSigInfo.Signer,
+-                                                                            Sequence<Reference<css::security::XCertificate> >());
+-                } catch (SecurityException& ) {
+-                    OSL_FAIL("Verification of certificate failed");
+-                    rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
+-                }
+                rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(
+                    rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
+             }
+-            else if (xGpgSecEnv.is()) // GPG
+            catch (SecurityException&)
+             {
+-                // TODO not ideal to retrieve cert by keyID, might
+-                // collide, or PGPKeyID format might change - can't we
+-                // keep the xCert itself in rInfo?
+-                rSigInfo.Signer = xGpgSecEnv->getCertificate( rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger("") );
+-                rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(rSigInfo.Signer,
+-                                                                           Sequence<Reference<css::security::XCertificate> >());
+                OSL_FAIL("Verification of certificate failed");
+                rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
+             }
+        }
+        else if (xGpgSecEnv.is()) // GPG
+        {
+            // TODO not ideal to retrieve cert by keyID, might
+            // collide, or PGPKeyID format might change - can't we
+            // keep the xCert itself in rInfo?
+            rSigInfo.Signer = xGpgSecEnv->getCertificate(
+                rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger(""));
+            rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(
+                rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
+        }
+ 
+-            // Time support again (#i38744#)
+-            Date aDate( rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year );
+-            tools::Time aTime( rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
+-                        rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds );
+-            rSigInfo.SignatureDate = aDate.GetDate();
+-            rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
+        // Time support again (#i38744#)
+        Date aDate(rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year);
+        tools::Time aTime(rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
+                          rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds);
+        rSigInfo.SignatureDate = aDate.GetDate();
+        rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
+ 
+-            rSigInfo.SignatureIsValid = ( rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED );
+        rSigInfo.SignatureIsValid
+            = (rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED);
+ 
+-            // Signature line info (ID + Images)
+-            if (!rInfo.ouSignatureLineId.isEmpty())
+-                rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
+        // Signature line info (ID + Images)
+        if (!rInfo.ouSignatureLineId.isEmpty())
+            rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
+ 
+-            if (rInfo.aValidSignatureImage.is())
+-                rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
+        if (rInfo.aValidSignatureImage.is())
+            rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
+ 
+-            if (rInfo.aInvalidSignatureImage.is())
+-                rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
+-
+-            // OOXML intentionally doesn't sign metadata.
+-            if ( rSigInfo.SignatureIsValid && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
+-            {
+-                 rSigInfo.SignatureIsValid =
+-                      DocumentSignatureHelper::checkIfAllFilesAreSigned(
+-                      aElementsToBeVerified, rInfo, mode);
+-            }
+-            if (eMode == DocumentSignatureMode::Content)
+-            {
+-                if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
+-                    rSigInfo.PartialDocumentSignature = true;
+-                else
+-                    rSigInfo.PartialDocumentSignature = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
+-            }
+        if (rInfo.aInvalidSignatureImage.is())
+            rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
+ 
+        // OOXML intentionally doesn't sign metadata.
+        if (rSigInfo.SignatureIsValid
+            && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
+        {
+            rSigInfo.SignatureIsValid = DocumentSignatureHelper::checkIfAllFilesAreSigned(
+                aElementsToBeVerified, rInfo, mode);
+        }
+        if (eMode == DocumentSignatureMode::Content)
+        {
+            if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
+                rSigInfo.PartialDocumentSignature = true;
+            else
+                rSigInfo.PartialDocumentSignature
+                    = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
+         }
+     }
+
+     return aInfos;
+ 
+ }
+diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+index 6ec834053a17..22c056e70da1 100644
+--- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+@@ -402,6 +402,7 @@ bool XMLSignatureHelper::ReadAndVerifySignatureStorageStream(const css::uno::Ref
+     catch(const uno::Exception&)
+     {
+         DBG_UNHANDLED_EXCEPTION("xmlsecurity.helper");
+        mbError = true;
+     }
+ 
+     mpXSecController->releaseSignatureReader();
+-- 
+2.32.0
+
--- a/SOURCES/0001-disable-libe-book-support.patch
+++ b/SOURCES/0001-disable-libe-book-support.patch
@ -0,0 +1,144 @@
+From 702a1ad668167a7a8efdd694c820b710a765bb53 Mon Sep 17 00:00:00 2001
+From: David Tardon <dtardon@redhat.com>
+Date: Thu, 21 Aug 2014 16:10:51 +0200
+Subject: [PATCH] disable libe-book support
+
+Change-Id: Ie915a9bd2acf7f3aeb8b0933252da33c17043bc4
+---
+ external/Module_external.mk                      | 1 -
+ filter/Configuration_filter.mk                   | 8 --------
+ writerperfect/Library_wpftwriter.mk              | 2 --
+ writerperfect/qa/unit/WpftFilterFixture.hxx      | 4 ----
+ writerperfect/qa/unit/WpftWriterFilterTest.cxx   | 5 -----
+ writerperfect/source/writer/wpftwriter.component | 5 -----
+ 6 files changed, 25 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index ac8dbc5..bb08d21 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -7696,9 +7696,6 @@ libo_PKG_VERSION([ETONYEK], [libetonyek-0.1], [0.1.5])
+
+ libo_CHECK_SYSTEM_MODULE([libfreehand],[FREEHAND],[libfreehand-0.1])
+
+-libo_CHECK_SYSTEM_MODULE([libebook],[EBOOK],[libe-book-0.1])
+-libo_PKG_VERSION([EBOOK], [libe-book-0.1], [0.1.2])
+-
+ libo_CHECK_SYSTEM_MODULE([libabw],[ABW],[libabw-0.1])
+
+ libo_CHECK_SYSTEM_MODULE([libpagemaker],[PAGEMAKER],[libpagemaker-0.0])
+diff --git a/external/Module_external.mk b/external/Module_external.mk
+index baf7215..397ad68 100644
+--- a/external/Module_external.mk
+++ b/external/Module_external.mk
+@@ -31,7 +31,6 @@ $(eval $(call gb_Module_add_moduledirs,external,\
+ 	$(call gb_Helper_optional,CPPUNIT,cppunit) \
+ 	$(call gb_Helper_optional,CT2N,ct2n) \
+ 	$(call gb_Helper_optional,CURL,curl) \
+-	$(call gb_Helper_optional,EBOOK,libebook) \
+ 	$(call gb_Helper_optional,EPM,epm) \
+ 	$(call gb_Helper_optional,EPOXY,epoxy) \
+ 	$(call gb_Helper_optional,EPUBGEN,libepubgen) \
+diff --git a/filter/Configuration_filter.mk b/filter/Configuration_filter.mk
+index 9702332..d250173 100644
+--- a/filter/Configuration_filter.mk
+++ b/filter/Configuration_filter.mk
+@@ -346,10 +346,6 @@ $(eval $(call filter_Configuration_add_types,fcfg_langpack,fcfg_writer_types.xcu
+ 	writer_OOXML \
+ 	writer_OOXML_Template \
+ 	writer_layout_dump_xml \
+-	writer_BroadBand_eBook \
+-	writer_FictionBook_2 \
+-	writer_PalmDoc \
+-	writer_Plucker_eBook \
+ 	writer_ApplePages \
+ 	MWAW_Text_Document \
+ 	Palm_Text_Document \
+@@ -394,10 +390,6 @@ $(eval $(call filter_Configuration_add_filters,fcfg_langpack,fcfg_writer_filters
+ 	OOXML_Text \
+ 	OOXML_Text_Template \
+ 	writer_layout_dump \
+-	BroadBand_eBook \
+-	FictionBook_2 \
+-	PalmDoc \
+-	Plucker_eBook \
+ 	ApplePages \
+ 	MWAW_Text_Document \
+ 	Palm_Text_Document \
+diff --git a/writerperfect/Library_wpftwriter.mk b/writerperfect/Library_wpftwriter.mk
+index 8993cca..b6e11f3 100644
+--- a/writerperfect/Library_wpftwriter.mk
+++ b/writerperfect/Library_wpftwriter.mk
+@@ -53,7 +53,6 @@ $(eval $(call gb_Library_use_libraries,wpftwriter,\
+ $(eval $(call gb_Library_use_externals,wpftwriter,\
+ 	abw \
+ 	boost_headers \
+-	ebook \
+ 	epubgen \
+ 	etonyek \
+ 	icu_headers \
+@@ -73,7 +72,6 @@ $(eval $(call gb_Library_use_externals,wpftwriter,\
+ 
+ $(eval $(call gb_Library_add_exception_objects,wpftwriter,\
+ 	writerperfect/source/writer/AbiWordImportFilter \
+-	writerperfect/source/writer/EBookImportFilter \
+ 	writerperfect/source/writer/EPUBExportDialog \
+ 	writerperfect/source/writer/EPUBExportFilter \
+ 	writerperfect/source/writer/EPUBExportUIComponent \
+diff --git a/writerperfect/qa/unit/WpftFilterFixture.hxx b/writerperfect/qa/unit/WpftFilterFixture.hxx
+index f324781..f42edb0 100644
+--- a/writerperfect/qa/unit/WpftFilterFixture.hxx
+++ b/writerperfect/qa/unit/WpftFilterFixture.hxx
+@@ -26,10 +26,6 @@
+         || ((major) == (req_major)                                                                 \
+             && ((minor) > (req_minor) || ((minor) == (req_minor) && ((micro) >= (req_micro)))))
+ 
+-#define REQUIRE_EBOOK_VERSION(major, minor, micro)                                                 \
+-    REQUIRE_VERSION(EBOOK_VERSION_MAJOR, EBOOK_VERSION_MINOR, EBOOK_VERSION_MICRO, major, minor,   \
+-                    micro)
+-
+ #define REQUIRE_ETONYEK_VERSION(major, minor, micro)                                               \
+     REQUIRE_VERSION(ETONYEK_VERSION_MAJOR, ETONYEK_VERSION_MINOR, ETONYEK_VERSION_MICRO, major,    \
+                     minor, micro)
+diff --git a/writerperfect/qa/unit/WpftWriterFilterTest.cxx b/writerperfect/qa/unit/WpftWriterFilterTest.cxx
+index 8bc4c7c..eca43ca 100644
+--- a/writerperfect/qa/unit/WpftWriterFilterTest.cxx
+++ b/writerperfect/qa/unit/WpftWriterFilterTest.cxx
+@@ -30,9 +30,6 @@ WpftWriterFilterTest::WpftWriterFilterTest()
+ 
+ void WpftWriterFilterTest::test()
+ {
+-    const writerperfect::test::WpftOptionalMap_t aEBookOptional{
+-        { "FictionBook2.fb2.zip", REQUIRE_EBOOK_VERSION(0, 1, 1) },
+-    };
+     const writerperfect::test::WpftOptionalMap_t aEtonyekOptional{
+         { "Pages_4.pages", REQUIRE_ETONYEK_VERSION(0, 1, 2) },
+         { "Pages_5.pages", REQUIRE_ETONYEK_VERSION(0, 1, 8) },
+@@ -54,8 +51,6 @@ void WpftWriterFilterTest::test()
+ 
+     doTest("com.sun.star.comp.Writer.AbiWordImportFilter",
+            "/writerperfect/qa/unit/data/writer/libabw/");
+-    doTest("org.libreoffice.comp.Writer.EBookImportFilter",
+-           "/writerperfect/qa/unit/data/writer/libe-book/", aEBookOptional);
+     doTest("com.sun.star.comp.Writer.MSWorksImportFilter",
+            "/writerperfect/qa/unit/data/writer/libwps/", aWpsOptional);
+     doTest("com.sun.star.comp.Writer.MWAWImportFilter",
+diff --git a/writerperfect/source/writer/wpftwriter.component b/writerperfect/source/writer/wpftwriter.component
+index 8ab4366..2720023 100644
+--- a/writerperfect/source/writer/wpftwriter.component
+++ b/writerperfect/source/writer/wpftwriter.component
+@@ -38,11 +38,6 @@
+     <service name="com.sun.star.document.ExtendedTypeDetection"/>
+     <service name="com.sun.star.document.ImportFilter"/>
+   </implementation>
+-  <implementation name="org.libreoffice.comp.Writer.EBookImportFilter"
+-      constructor="org_libreoffice_comp_Writer_EBookImportFilter_get_implementation">
+-    <service name="com.sun.star.document.ExtendedTypeDetection"/>
+-    <service name="com.sun.star.document.ImportFilter"/>
+-  </implementation>
+   <implementation name="org.libreoffice.comp.Writer.PagesImportFilter"
+       constructor="org_libreoffice_comp_Writer_PagesImportFilter_get_implementation">
+     <service name="com.sun.star.document.ExtendedTypeDetection"/>
+-- 
+2.26.2
+
--- a/SOURCES/0001-disble-tip-of-the-day-dialog-by-default.patch
+++ b/SOURCES/0001-disble-tip-of-the-day-dialog-by-default.patch
@ -0,0 +1,26 @@
+From d6e2cdb0023e422546e3ece5bf9915f7c490ced8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 20 Mar 2020 14:24:05 +0000
+Subject: [PATCH] disble tip-of-the-day dialog by default
+
+Change-Id: Ie7f0e3fe3dda12c2ec88c376d2b57419253ae5cf
+---
+ officecfg/registry/schema/org/openoffice/Office/Common.xcs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index e7c339e2e22e..9aa88ef1aa02 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -5570,7 +5570,7 @@
+         <info>
+           <desc>Determines whether the Tip-of-the-Day dialog is shown on startup.</desc>
+         </info>
+-        <value>true</value>
+        <value>false</value>
+       </prop>
+       <prop oor:name="LastTipOfTheDayShown" oor:type="xs:int" oor:nillable="false">
+           <info>
+-- 
+2.24.1
+
--- a/SOURCES/0001-don-t-suppress-crashes.patch
+++ b/SOURCES/0001-don-t-suppress-crashes.patch
@ -0,0 +1,35 @@
+From a0e6d2abeed9d64fe7862a7664ba80a6178bf3f2 Mon Sep 17 00:00:00 2001
+From: David Tardon <dtardon@redhat.com>
+Date: Tue, 8 Nov 2016 11:50:06 +0100
+Subject: [PATCH] don't suppress crashes
+
+An automatic restart after a crash makes the crash invisible to abrt.
+
+Change-Id: I3854e619356049b144b08575879d289a3c12e4c9
+---
+ desktop/source/app/app.cxx | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/desktop/source/app/app.cxx b/desktop/source/app/app.cxx
+index 53365f4..3a3bac8 100644
+--- a/desktop/source/app/app.cxx
+++ b/desktop/source/app/app.cxx
+@@ -1312,14 +1312,12 @@ void Desktop::Exception(ExceptionCategory nCategory)
+             if( bRestart )
+             {
+                 RequestHandler::Disable();
+-                if( pSignalHandler )
+-                    osl_removeSignalHandler( pSignalHandler );
+ 
+                 restartOnMac(false);
+                 if ( m_rSplashScreen.is() )
+                     m_rSplashScreen->reset();
+ 
+-                _exit( EXITHELPER_CRASH_WITH_RESTART );
+                return;
+             }
+             else
+             {
+-- 
+2.9.3
+
--- a/SOURCES/0001-export-HYPERLINK-target-in-html-clipboard-export.patch
+++ b/SOURCES/0001-export-HYPERLINK-target-in-html-clipboard-export.patch
@ -0,0 +1,64 @@
+From 13aba101eadfe4f67a930ac7231d26ece658bbec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 28 Sep 2020 14:55:47 +0100
+Subject: [PATCH] export HYPERLINK target in html clipboard export
+
+Change-Id: Ia77e4bd8a5b54636d0e9e561360128202a81420b
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103557
+Tested-by: Jenkins
+Reviewed-by: Eike Rathke <erack@redhat.com>
+---
+ sc/source/filter/html/htmlexp.cxx | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/sc/source/filter/html/htmlexp.cxx b/sc/source/filter/html/htmlexp.cxx
+index 6122c9b6c45c..13792201c8b0 100644
+--- a/sc/source/filter/html/htmlexp.cxx
+++ b/sc/source/filter/html/htmlexp.cxx
+@@ -37,6 +37,7 @@
+ #include <sfx2/docfile.hxx>
+ #include <sfx2/frmhtmlw.hxx>
+ #include <sfx2/objsh.hxx>
+#include <svl/stritem.hxx>
+ #include <svl/urihelper.hxx>
+ #include <svtools/htmlkywd.hxx>
+ #include <svtools/htmlout.hxx>
+@@ -1127,6 +1128,26 @@ void ScHTMLExport::WriteCell( sc::ColumnBlockPosition& rBlockPos, SCCOL nCol, SC
+         TAG_ON(aStr.makeStringAndClear().getStr());
+     }
+ 
+    OUString aURL;
+    bool bWriteHyperLink(false);
+    if (aCell.meType == CELLTYPE_FORMULA)
+    {
+        ScFormulaCell* pFCell = aCell.mpFormula;
+        if (pFCell->IsHyperLinkCell())
+        {
+            OUString aCellText;
+            pFCell->GetURLResult(aURL, aCellText);
+            bWriteHyperLink = true;
+        }
+    }
+
+    if (bWriteHyperLink)
+    {
+        OString aURLStr = HTMLOutFuncs::ConvertStringToHTML(aURL, eDestEnc, &aNonConvertibleChars);
+        OString aStr = OOO_STRING_SVTOOLS_HTML_anchor " " OOO_STRING_SVTOOLS_HTML_O_href "=\"" + aURLStr + "\"";
+        TAG_ON(aStr.getStr());
+    }
+
+     OUString aStrOut;
+     bool bFieldText = false;
+ 
+@@ -1174,6 +1195,8 @@ void ScHTMLExport::WriteCell( sc::ColumnBlockPosition& rBlockPos, SCCOL nCol, SC
+     if ( pGraphEntry )
+         WriteGraphEntry( pGraphEntry );
+ 
+    if (bWriteHyperLink) { TAG_OFF(OOO_STRING_SVTOOLS_HTML_anchor); }
+
+     if ( bSetFont )     TAG_OFF( OOO_STRING_SVTOOLS_HTML_font );
+     if ( bCrossedOut )  TAG_OFF( OOO_STRING_SVTOOLS_HTML_strikethrough );
+     if ( bUnderline )   TAG_OFF( OOO_STRING_SVTOOLS_HTML_underline );
+-- 
+2.26.2
+
--- a/SOURCES/0001-fix-detecting-qrcodegen.patch
+++ b/SOURCES/0001-fix-detecting-qrcodegen.patch
@ -0,0 +1,40 @@
+From ddf72365b7e7c67b2580e328e55de6eb988b8787 Mon Sep 17 00:00:00 2001
+From: Thierry Vignaud <thierry.vignaud@gmail.com>
+Date: Thu, 30 Jan 2020 11:19:20 +0000
+Subject: [PATCH] fix detecting qrcodegen
+
+Change-Id: Ib945b57420083489273cefc5655eb50932b5a3f8
+---
+ configure.ac                           |    2 +-
+ cui/source/dialogs/QrCodeGenDialog.cxx |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 388bee3..c061349 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -10092,7 +10092,7 @@ else
+         AC_MSG_RESULT([external])
+         SYSTEM_QRCODEGEN=TRUE
+         AC_LANG_PUSH([C++])
+-        AC_CHECK_HEADER(qrcodegen/QrCode.hpp, [],
+        AC_CHECK_HEADER(qrcodegencpp/QrCode.hpp, [],
+             [AC_MSG_ERROR(qrcodegen headers not found.)], [#include <stdexcept>])
+         AC_CHECK_LIB([qrcodegencpp], [main], [:],
+             [ AC_MSG_ERROR(qrcodegen C++ library not found.) ], [])
+diff --git a/cui/source/dialogs/QrCodeGenDialog.cxx b/cui/source/dialogs/QrCodeGenDialog.cxx
+index 6277e76..f8dd327 100644
+--- a/cui/source/dialogs/QrCodeGenDialog.cxx
+++ b/cui/source/dialogs/QrCodeGenDialog.cxx
+@@ -20,7 +20,7 @@
+ 
+ #if ENABLE_QRCODEGEN
+ #if defined(SYSTEM_QRCODEGEN)
+-#include <qrcodegen/QrCode.hpp>
+#include <qrcodegencpp/QrCode.hpp>
+ #else
+ #include <QrCode.hpp>
+ #endif
+-- 
+2.26.2
+
--- a/SOURCES/0001-munge-cmis-headers-to-remove-exception-specs.patch
+++ b/SOURCES/0001-munge-cmis-headers-to-remove-exception-specs.patch
--- a/SOURCES/0001-replace-Palatino-Linotype-with-Liberation-Serif.patch
+++ b/SOURCES/0001-replace-Palatino-Linotype-with-Liberation-Serif.patch
@ -0,0 +1,26 @@
+From 06b19641b0eac7b7992fae861eb4807397c9aee4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 28 Oct 2020 10:03:23 +0000
+Subject: [PATCH] replace 'Palatino Linotype' with 'Liberation Serif'
+
+for consistent font replacement
+
+Change-Id: I3c124c0adcab8ac2dd7f989c2fa5c97182e32b64
+---
+ sw/qa/extras/layout/data/forcepoint75-1.rtf | Bin 88740 -> 88738 bytes
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+
+diff --git a/sw/qa/extras/layout/data/forcepoint75-1.rtf b/sw/qa/extras/layout/data/forcepoint75-1.rtf
+index 01a52963757d8568e5ae8b80b7767c924c37a407..263a585c57e162caf1c9f9dd3aee4f3d8aa3edd2 100644
+GIT binary patch
+delta 85
+zcmZ3om37fp)(y#wVm_HksYQt;nfZAN!Kp==Y1XyXF=>XA=QD{5pi50&#At*e*!+}n
+M`%^~7{Sk~@09cV9Z2$lO
+
+delta 104
+zcmZ3qm37Hh)(y#w_5q1Gi6xnN`3gQjqNK7Q)w;GiCe1J=ttdY?F)t>$Al)D)Ejc5x
+ds5rI6KmkMb<OPgIf*7LBj~KT<Vr1MO0RTX3C};ox
+
+-- 
+2.26.2
+
--- a/SOURCES/0001-replace-boost-bimap-in-sdext-pdfimport.patch
+++ b/SOURCES/0001-replace-boost-bimap-in-sdext-pdfimport.patch
@ -0,0 +1,110 @@
+From 193b49763a03d63ba79db50c1fa0563ec0d6b0c3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 29 Jan 2020 12:44:52 +0000
+Subject: [PATCH] replace boost::bimap in sdext pdfimport
+
+Change-Id: Ie324a0b81931bbd427483878a87beeca455ada18
+---
+ sdext/source/pdfimport/inc/pdfiprocessor.hxx  | 12 ++++-------
+ sdext/source/pdfimport/tree/pdfiprocessor.cxx | 21 +++++++++++--------
+ 2 files changed, 16 insertions(+), 17 deletions(-)
+
+diff --git a/sdext/source/pdfimport/inc/pdfiprocessor.hxx b/sdext/source/pdfimport/inc/pdfiprocessor.hxx
+index 89f9d601b7b0..9e08d6a6a765 100644
+--- a/sdext/source/pdfimport/inc/pdfiprocessor.hxx
+++ b/sdext/source/pdfimport/inc/pdfiprocessor.hxx
+@@ -37,9 +37,6 @@
+ #include "treevisitorfactory.hxx"
+ #include "genericelements.hxx"
+ 
+-#include <boost/bimap/bimap.hpp>
+-#include <boost/bimap/unordered_set_of.hpp>
+-
+ namespace pdfi
+ {
+ 
+@@ -160,10 +157,8 @@ namespace pdfi
+         typedef std::unordered_map<sal_Int32,FontAttributes> IdToFontMap;
+         typedef std::unordered_map<FontAttributes,sal_Int32,FontAttrHash> FontToIdMap;
+ 
+-        typedef boost::bimaps::bimap<
+-                             boost::bimaps::unordered_set_of<GraphicsContext, GraphicsContextHash>,
+-                             boost::bimaps::unordered_set_of<sal_Int32>
+-                            > GCToIdBiMap;
+        typedef std::unordered_map<sal_Int32,GraphicsContext> IdToGCMap;
+        typedef std::unordered_map<GraphicsContext, sal_Int32, GraphicsContextHash> GCToIdMap;
+ 
+         typedef std::vector<GraphicsContext> GraphicsContextStack;
+ 
+@@ -178,7 +173,8 @@ namespace pdfi
+ 
+         GraphicsContextStack               m_aGCStack;
+         sal_Int32                          m_nNextGCId;
+-        GCToIdBiMap                        m_aGCToId;
+        IdToGCMap                          m_aIdToGC;
+        GCToIdMap                          m_aGCToId;
+ 
+         ImageContainer                     m_aImages;
+ 
+diff --git a/sdext/source/pdfimport/tree/pdfiprocessor.cxx b/sdext/source/pdfimport/tree/pdfiprocessor.cxx
+index c6baa7fee8b2..ed2eaf6510b9 100644
+--- a/sdext/source/pdfimport/tree/pdfiprocessor.cxx
+++ b/sdext/source/pdfimport/tree/pdfiprocessor.cxx
+@@ -54,6 +54,7 @@ namespace pdfi
+     m_aFontToId(),
+     m_aGCStack(),
+     m_nNextGCId( 1 ),
+    m_aIdToGC(),
+     m_aGCToId(),
+     m_aImages(),
+     m_nPages(0),
+@@ -65,12 +66,13 @@ namespace pdfi
+     aDefFont.isBold     = false;
+     aDefFont.isItalic   = false;
+     aDefFont.size       = 10*PDFI_OUTDEV_RESOLUTION/72;
+-    m_aIdToFont[ 0 ]    = aDefFont;
+-    m_aFontToId[ aDefFont ] = 0;
+    m_aIdToFont.insert({0, aDefFont});
+    m_aFontToId.insert({aDefFont, 0});
+ 
+     GraphicsContext aDefGC;
+     m_aGCStack.push_back( aDefGC );
+-    m_aGCToId.insert(GCToIdBiMap::relation(aDefGC, 0));
+    m_aGCToId.insert({aDefGC, 0});
+    m_aIdToGC.insert({0, aDefGC});
+ }
+ 
+ void PDFIProcessor::setPageNum( sal_Int32 nPages )
+@@ -468,12 +470,13 @@ const FontAttributes& PDFIProcessor::getFont( sal_Int32 nFontId ) const
+ sal_Int32 PDFIProcessor::getGCId( const GraphicsContext& rGC )
+ {
+     sal_Int32 nGCId = 0;
+-    auto it = m_aGCToId.left.find( rGC );
+-    if( it != m_aGCToId.left.end() )
+    auto it = m_aGCToId.find( rGC );
+    if( it != m_aGCToId.end() )
+         nGCId = it->second;
+     else
+     {
+-        m_aGCToId.insert(GCToIdBiMap::relation(rGC, m_nNextGCId));
+        m_aGCToId.insert({rGC, m_nNextGCId});
+        m_aIdToGC.insert({m_nNextGCId, rGC});
+         nGCId = m_nNextGCId;
+         m_nNextGCId++;
+     }
+@@ -483,9 +486,9 @@ sal_Int32 PDFIProcessor::getGCId( const GraphicsContext& rGC )
+ 
+ const GraphicsContext& PDFIProcessor::getGraphicsContext( sal_Int32 nGCId ) const
+ {
+-    auto it = m_aGCToId.right.find( nGCId );
+-    if( it == m_aGCToId.right.end() )
+-        it = m_aGCToId.right.find( 0 );
+    auto it = m_aIdToGC.find( nGCId );
+    if( it == m_aIdToGC.end() )
+        it = m_aIdToGC.find( 0 );
+     return it->second;
+ }
+ 
+-- 
+2.24.1
+
--- a/SOURCES/0001-rhbz-1870501-crash-on-reexport-of-odg.patch
+++ b/SOURCES/0001-rhbz-1870501-crash-on-reexport-of-odg.patch
--- a/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
+++ b/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
@ -0,0 +1,82 @@
+From 8bfdd84ffcffe19aa6c495a0772e1a5fcb9a5124 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 25 Sep 2020 11:22:03 +0100
+Subject: [PATCH] rhbz#1882616 move cursor one step at a time in the desired
+ direction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+until we get to the target position. The break iterator operates in graphemes
+so we can't just move Left/Right the amount of utf-16 we want to move.
+
+Change-Id: I25d4e9285deae374f85dcaadbf4601bc213a89de
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103380
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit bf858622e543163a23db766912ea6b121f447e6d)
+---
+ sw/source/core/edit/editsh.cxx | 40 +++++++++++++++++++++++++++++-----
+ 1 file changed, 35 insertions(+), 5 deletions(-)
+
+diff --git a/sw/source/core/edit/editsh.cxx b/sw/source/core/edit/editsh.cxx
+index 8f84ce42ed75..872d92d7afcc 100644
+--- a/sw/source/core/edit/editsh.cxx
+++ b/sw/source/core/edit/editsh.cxx
+@@ -988,7 +988,8 @@ OUString SwEditShell::DeleteExtTextInput( bool bInsText )
+ 
+ void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
+ {
+-    const SwPosition& rPos = *GetCursor()->GetPoint();
+    SwPaM* pCurrentCursor = GetCursor();
+    const SwPosition& rPos = *pCurrentCursor->GetPoint();
+     SwExtTextInput* pInput = GetDoc()->GetExtTextInput( rPos.nNode.GetNode() );
+     if( !pInput )
+         return;
+@@ -1005,10 +1006,39 @@ void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
+     // ugly but works
+     ShowCursor();
+     const sal_Int32 nDiff = nNewCursorPos - rPos.nContent.GetIndex();
+-    if( 0 > nDiff )
+-        Left( -nDiff, CRSR_SKIP_CHARS );
+-    else if( 0 < nDiff )
+-        Right( nDiff, CRSR_SKIP_CHARS );
+    if( nDiff != 0)
+    {
+        bool bLeft = nDiff < 0;
+        sal_Int32 nMaxGuard = std::abs(nDiff);
+        while (true)
+        {
+            auto nOldPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
+            if (bLeft)
+                Left(1, CRSR_SKIP_CHARS);
+            else
+                Right(1, CRSR_SKIP_CHARS);
+            auto nNewPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
+
+            // expected success
+            if (nNewPos == nNewCursorPos)
+                break;
+
+            if (nNewPos == nOldPos)
+            {
+                // if there was no movement, we have failed for some reason
+                SAL_WARN("sw.core", "IM cursor move failed");
+                break;
+            }
+
+            if (--nMaxGuard == 0)
+            {
+                // if it takes more cursor moves than there are utf-16 chars to move past
+                // something has probably gone wrong
+                SAL_WARN("sw.core", "IM abandoning cursor positioning");
+                break;
+            }
+        }
+    }
+ 
+     SetOverwriteCursor( rData.IsCursorOverwrite() );
+ 
+-- 
+2.29.2
+
--- a/SOURCES/0001-rhbz-1891326-suggest-package-install-of-the-most-app.patch
+++ b/SOURCES/0001-rhbz-1891326-suggest-package-install-of-the-most-app.patch
@ -0,0 +1,27 @@
+From 3f4885f3012132e915031461036a76e693489652 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Sun, 25 Oct 2020 20:39:50 +0000
+Subject: [PATCH] rhbz#1891326 suggest package install of the most appropiate
+ pt langpack
+
+Change-Id: I87ff1a941a3a5dc0c321440a9c286ae73c9d0384
+---
+ svtools/source/misc/langhelp.cxx | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/svtools/source/misc/langhelp.cxx b/svtools/source/misc/langhelp.cxx
+index e64a3b869076..acaf2c6e24f3 100644
+--- a/svtools/source/misc/langhelp.cxx
+++ b/svtools/source/misc/langhelp.cxx
+@@ -139,6 +139,8 @@ OUString getInstalledLocaleForSystemUILanguage(const css::uno::Sequence<OUString
+                         aPackages.emplace_back("libreoffice-langpack-zh-Hans");
+                     else if (MsLangId::isTraditionalChinese(eType))
+                         aPackages.emplace_back("libreoffice-langpack-zh-Hant");
+                    else if (install == "pt")
+                        aPackages.emplace_back("libreoffice-langpack-pt-PT");
+                     else
+                         aPackages.emplace_back("libreoffice-langpack-" + install);
+                 }
+-- 
+2.26.2
+
--- a/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
+++ b/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
@ -0,0 +1,491 @@
+From b49380bd288e642352cb7ddc1c050e2fb34b5b43 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 13 Jul 2021 12:38:07 +0100
+Subject: [PATCH] rhbz#1980800 allow --convert-to csv to write each sheet to a
+ separate file
+
+Related: tdf#135762 except only currently implemented for command line use
+
+sample usage:
+soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,-1 sample.ods
+where the new (11th!) final token ("-1") enables writing each sheet to a
+new file based on the suggested target name so output in this example
+is files sample-Sheet1.csv and sample-Sheet2.csv
+
+Only -1 for 'all sheets' vs 0 for existing 'current sheet only' (which
+is always sheet 0 from the command line) are currently options but the
+token could be expanded in the future to select specific sheets to
+export.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118850
+Tested-by: Jenkins
+Reviewed-by: Eike Rathke <erack@redhat.com>
+(cherry picked from commit b8903bc106dad036acb3d117e5c4fc955697fe02)
+
+Related: tdf#135762 Allow --convert-to csv to specify 1-based sheet number
+
+Same multifile mechanism as for -1 all sheets is used, so
+
+soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,2 sample.ods
+
+writes a file sample-Sheet2.csv
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118971
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit fda91f8be16ba760e360940ebafd6244c648cb8c)
+
+Related: tdf#135762 Suppress cout if not command line
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119294
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 0cda081c9aa3b3dcb363f97bac60c845ce9a13e0)
+
+Change-Id: Ib99a120f1a2c8d1008a7a3c59a6b39f572fb346e
+b9248c9561e4e340c88458ac5dfd159e443a4cfd
+9431221aadf97739bb197871f25fa151ef4c391c
+
+Plus follow-up fix
+<https://git.libreoffice.org/core/+/d768757872ad25219fa291acd623ab98924acaaa%5E%21>
+"tdf#129829 sfx2: fix handling of password to open vs modify" (which happens to
+also fix saving to smb shares, in addition to the Windows-specific issue it was
+originally meant to fix), plus the relevant parts of its preceding
+<https://git.libreoffice.org/core/+/037cd13af81f8a1169d01e95036ed942f261f9a6%5E%21>
+"sw reqif-xhtml export: add a new RTFOLEMimeType parameter" introducing
+SfxMedium::SetArgs.
+---
+ desktop/source/app/dispatchwatcher.cxx |  50 +++++++--
+ include/sfx2/docfile.hxx               |   2 +
+ sc/source/ui/dbgui/imoptdlg.cxx        |  16 ++-
+ sc/source/ui/docshell/docsh.cxx        | 141 +++++++++++++++++++++----
+ sc/source/ui/inc/docsh.hxx             |   2 +-
+ sc/source/ui/inc/imoptdlg.hxx          |   6 +-
+ sfx2/source/doc/docfile.cxx            |  13 +++
+ 7 files changed, 194 insertions(+), 36 deletions(-)
+
+diff --git a/desktop/source/app/dispatchwatcher.cxx b/desktop/source/app/dispatchwatcher.cxx
+index 04140173c6d1..a5365da618e8 100644
+--- a/desktop/source/app/dispatchwatcher.cxx
+++ b/desktop/source/app/dispatchwatcher.cxx
+@@ -30,6 +30,7 @@
+ #include "dispatchwatcher.hxx"
+ #include <rtl/ustring.hxx>
+ #include <comphelper/processfactory.hxx>
+#include <comphelper/string.hxx>
+ #include <comphelper/synchronousdispatch.hxx>
+ #include <com/sun/star/io/IOException.hpp>
+ #include <com/sun/star/util/XCloseable.hpp>
+@@ -604,6 +605,8 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                                 aFilter = impl_GuessFilter( aOutFile, aDocService );
+                             }
+ 
+                            bool bMultiFileTarget = false;
+
+                             if (aFilter.isEmpty())
+                             {
+                                 std::cerr << "Error: no export filter" << std::endl;
+@@ -611,29 +614,54 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                             else
+                             {
+                                 sal_Int32 nFilterOptionsIndex = aFilter.indexOf(':');
+-                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 3 : 2;
+                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 4 : 3;
+ 
+                                 if ( !aImgOut.isEmpty() )
+                                     nProps +=1;
+                                 Sequence<PropertyValue> conversionProperties( nProps );
+-                                conversionProperties[0].Name = "Overwrite";
+-                                conversionProperties[0].Value <<= true;
+                                conversionProperties[0].Name = "ConversionRequestOrigin";
+                                conversionProperties[0].Value <<= OUString("CommandLine");
+                                conversionProperties[1].Name = "Overwrite";
+                                conversionProperties[1].Value <<= true;
+ 
+-                                conversionProperties[1].Name = "FilterName";
+                                conversionProperties[2].Name = "FilterName";
+                                 if( 0 < nFilterOptionsIndex )
+                                 {
+-                                    conversionProperties[1].Value <<= aFilter.copy(0, nFilterOptionsIndex);
+                                    OUString sFilterName = aFilter.copy(0, nFilterOptionsIndex);
+                                    OUString sFilterOptions = aFilter.copy(nFilterOptionsIndex + 1);
+
+                                    if (sFilterName == "Text - txt - csv (StarCalc)")
+                                    {
+                                        sal_Int32 nIdx(0);
+                                        // If the 11th token is '-1' then we export a file
+                                        // per sheet where the file name is based on the suggested
+                                        // output filename concatenated with the sheet name, so adjust
+                                        // the output and overwrite messages
+                                        // If the 11th token is not present or numeric 0 then the
+                                        // default sheet is exported with the output filename. If it
+                                        // is numeric >0 then that sheet (1-based) with the output
+                                        // filename concatenated with the sheet name. So even if
+                                        // that is a single file, the multi file target mechanism is
+                                        // used.
+                                        const OUString aTok(sFilterOptions.getToken(11, ',', nIdx));
+                                        // Actual validity is checked in Calc, here just check for
+                                        // presence of numeric value at start.
+                                        bMultiFileTarget = (!aTok.isEmpty() && aTok.toInt32() != 0);
+                                    }
+
+                                    conversionProperties[2].Value <<= sFilterName;
+ 
+-                                    conversionProperties[2].Name = "FilterOptions";
+-                                    conversionProperties[2].Value <<= aFilter.copy(nFilterOptionsIndex + 1);
+                                    conversionProperties[3].Name = "FilterOptions";
+                                    conversionProperties[3].Value <<= sFilterOptions;
+                                 }
+                                 else
+                                 {
+-                                    conversionProperties[1].Value <<= aFilter;
+                                    conversionProperties[2].Value <<= aFilter;
+                                 }
+ 
+                                 if ( !aImgOut.isEmpty() )
+                                 {
+                                    assert(conversionProperties[nProps-1].Name.isEmpty());
+                                     conversionProperties[nProps-1].Name = "ImageFilter";
+                                     conversionProperties[nProps-1].Value <<= aImgOut;
+                                 }
+@@ -645,9 +673,11 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                                 OString aTargetURL8 = OUStringToOString(aTempName, osl_getThreadTextEncoding());
+                                 if (aDispatchRequest.aRequestType != REQUEST_CAT)
+                                 {
+-                                    std::cout << "convert " << aSource8 << " -> " << aTargetURL8;
+                                    std::cout << "convert " << aSource8;
+                                    if (!bMultiFileTarget)
+                                        std::cout << " -> " << aTargetURL8;
+                                     std::cout << " using filter : " << OUStringToOString(aFilter, osl_getThreadTextEncoding()) << std::endl;
+-                                    if (FStatHelper::IsDocument(aOutFile))
+                                    if (!bMultiFileTarget && FStatHelper::IsDocument(aOutFile))
+                                         std::cout << "Overwriting: " << OUStringToOString(aTempName, osl_getThreadTextEncoding()) << std::endl ;
+                                 }
+                                 try
+diff --git a/include/sfx2/docfile.hxx b/include/sfx2/docfile.hxx
+index 2019b5738c01..2886348 100644
+--- a/include/sfx2/docfile.hxx
+++ b/include/sfx2/docfile.hxx
+@@ -108,6 +108,8 @@ public:
+     const OUString&     GetOrigURL() const;
+ 
+     SfxItemSet  *       GetItemSet() const;
+    void SetArgs(const css::uno::Sequence<css::beans::PropertyValue>& rArgs);
+    css::uno::Sequence<css::beans::PropertyValue> GetArgs() const;
+     void                Close(bool bInDestruction = false);
+     void                CloseAndRelease();
+     void                ReOpen();
+diff --git a/sc/source/ui/dbgui/imoptdlg.cxx b/sc/source/ui/dbgui/imoptdlg.cxx
+index 26781924baac..7aa8c8acb061 100644
+--- a/sc/source/ui/dbgui/imoptdlg.cxx
+++ b/sc/source/ui/dbgui/imoptdlg.cxx
+@@ -20,6 +20,7 @@
+ #include <imoptdlg.hxx>
+ #include <asciiopt.hxx>
+ #include <comphelper/string.hxx>
+#include <unotools/charclass.hxx>
+ #include <osl/thread.h>
+ #include <global.hxx>
+ 
+@@ -43,6 +44,7 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
+     bSaveNumberAsSuch = true;
+     bSaveFormulas = false;
+     bRemoveSpace = false;
+    nSheetToExport = 0;
+     sal_Int32 nTokenCount = comphelper::string::getTokenCount(rStr, ',');
+     if ( nTokenCount >= 3 )
+     {
+@@ -76,6 +78,16 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
+                 bSaveFormulas = rStr.getToken(0, ',', nIdx) == "true";
+             if ( nTokenCount >= 11 )
+                 bRemoveSpace = rStr.getToken(0, ',', nIdx) == "true";
+            if ( nTokenCount >= 12 )
+            {
+                const OUString aTok(rStr.getToken(0, ',', nIdx));
+                if (aTok == "-1")
+                    nSheetToExport = -1;    // all
+                else if (aTok.isEmpty() || CharClass::isAsciiNumeric(aTok))
+                    nSheetToExport = aTok.toInt32();
+                else
+                    nSheetToExport = -23;   // invalid, force error
+            }
+         }
+     }
+ }
+@@ -99,7 +111,9 @@ OUString ScImportOptions::BuildString() const
+             "," +
+             OUString::boolean( bSaveFormulas ) +  // "save formulas": not in ScAsciiOptions
+             "," +
+-            OUString::boolean( bRemoveSpace );    // same as "Remove space" in ScAsciiOptions
+            OUString::boolean( bRemoveSpace ) +  // same as "Remove space" in ScAsciiOptions
+            "," +
+            OUString::number(nSheetToExport) ;  // Only available for command line --convert-to
+ 
+     return aResult;
+ }
+diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
+index bd7402231333..1c544fb6fa1a 100644
+--- a/sc/source/ui/docshell/docsh.cxx
+++ b/sc/source/ui/docshell/docsh.cxx
+@@ -45,6 +45,7 @@
+ #include <sfx2/objface.hxx>
+ #include <sfx2/viewfrm.hxx>
+ #include <svl/documentlockfile.hxx>
+#include <svl/fstathelper.hxx>
+ #include <svl/sharecontrolfile.hxx>
+ #include <svl/urihelper.hxx>
+ #include <osl/file.hxx>
+@@ -120,6 +121,7 @@
+ #include <comphelper/processfactory.hxx>
+ #include <comphelper/string.hxx>
+ #include <unotools/configmgr.hxx>
+#include <unotools/ucbstreamhelper.hxx>
+ #include <uiitems.hxx>
+ #include <dpobject.hxx>
+ #include <markdata.hxx>
+@@ -1920,7 +1922,7 @@ void escapeTextSep(sal_Int32 nPos, const StrT& rStrDelim, StrT& rStr)
+ 
+ }
+ 
+-void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt )
+void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt, SCTAB nTab )
+ {
+     sal_Unicode cDelim    = rAsciiOpt.nFieldSepCode;
+     sal_Unicode cStrDelim = rAsciiOpt.nTextSepCode;
+@@ -1966,7 +1968,6 @@ void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt
+ 
+     SCCOL nStartCol = 0;
+     SCROW nStartRow = 0;
+-    SCTAB nTab = GetSaveTab();
+     SCCOL nEndCol;
+     SCROW nEndRow;
+     m_aDocument.GetCellArea( nTab, nEndCol, nEndRow );
+@@ -2384,35 +2385,129 @@ bool ScDocShell::ConvertTo( SfxMedium &rMed )
+     }
+     else if (aFltName == pFilterAscii)
+     {
+-        SvStream* pStream = rMed.GetOutStream();
+-        if (pStream)
+        OUString sItStr;
+        SfxItemSet*  pSet = rMed.GetItemSet();
+        const SfxPoolItem* pItem;
+        if ( pSet && SfxItemState::SET ==
+             pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
+         {
+-            OUString sItStr;
+-            SfxItemSet*  pSet = rMed.GetItemSet();
+-            const SfxPoolItem* pItem;
+-            if ( pSet && SfxItemState::SET ==
+-                 pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
+            sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
+        }
+
+        if ( sItStr.isEmpty() )
+        {
+            //  default for ascii export (from API without options):
+            //  ISO8859-1/MS_1252 encoding, comma, double quotes
+
+            ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
+            sItStr = aDefOptions.BuildString();
+        }
+
+        weld::WaitObject aWait( GetActiveDialogParent() );
+        ScImportOptions aOptions( sItStr );
+
+        if (aOptions.nSheetToExport)
+        {
+            // Only from command line --convert-to
+            bRet = true;
+
+            // Verbose only from command line, not UI (in case we actually
+            // implement that) nor macro filter options.
+            bool bVerbose = false;
+            const css::uno::Sequence<css::beans::PropertyValue> & rArgs = rMed.GetArgs();
+            const auto pProp = std::find_if( rArgs.begin(), rArgs.end(),
+                    [](const css::beans::PropertyValue& rProp) { return rProp.Name == "ConversionRequestOrigin"; });
+            if (pProp != rArgs.end())
+             {
+-                sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
+                OUString aOrigin;
+                pProp->Value >>= aOrigin;
+                bVerbose = (aOrigin == "CommandLine");
+             }
+ 
+-            if ( sItStr.isEmpty() )
+            SCTAB nStartTab;
+            SCTAB nCount = m_aDocument.GetTableCount();
+            if (aOptions.nSheetToExport == -1)
+             {
+-                //  default for ascii export (from API without options):
+-                //  ISO8859-1/MS_1252 encoding, comma, double quotes
+-
+-                ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
+-                sItStr = aDefOptions.BuildString();
+                // All sheets.
+                nStartTab = 0;
+            }
+            else if (0 < aOptions.nSheetToExport && aOptions.nSheetToExport <= nCount)
+            {
+                // One sheet, 1-based.
+                nCount = aOptions.nSheetToExport;
+                nStartTab = nCount - 1;
+            }
+            else
+            {
+                // Usage error, no export but log.
+                if (bVerbose)
+                {
+                    if (aOptions.nSheetToExport < 0)
+                        std::cout << "Bad sheet number string given." << std::endl;
+                    else
+                        std::cout << "No sheet number " << aOptions.nSheetToExport
+                            << ", number of sheets is " << nCount << std::endl;
+                }
+                nStartTab = 0;
+                nCount = 0;
+                SetError(SCERR_EXPORT_DATA);
+                bRet = false;
+             }
+ 
+-            weld::WaitObject aWait( GetActiveDialogParent() );
+-            ScImportOptions aOptions( sItStr );
+-            AsciiSave( *pStream, aOptions );
+-            bRet = true;
+            INetURLObject aURLObject(rMed.GetURLObject());
+            OUString sExt = aURLObject.CutExtension();
+            OUString sBaseName = aURLObject.GetLastName();
+            aURLObject.CutLastName();
+ 
+-            if (m_aDocument.GetTableCount() > 1)
+-                if (!rMed.GetError())
+-                    rMed.SetError(SCWARN_EXPORT_ASCII);
+            for (SCTAB i = nStartTab; i < nCount; ++i)
+            {
+                OUString sTabName;
+                if (!m_aDocument.GetName(i, sTabName))
+                    sTabName = OUString::number(i);
+                INetURLObject aSheetURLObject(aURLObject);
+                OUString sFileName = sBaseName + "-" + sTabName;
+                if (!sExt.isEmpty())
+                    sFileName = sFileName + "." + sExt;
+                aSheetURLObject.Append(sFileName);
+
+                // log similar to DispatchWatcher::executeDispatchRequests
+                OUString aOutFile = aSheetURLObject.GetMainURL(INetURLObject::DecodeMechanism::NONE);
+                if (bVerbose)
+                {
+                    OUString aDisplayedName;
+                    if (osl::FileBase::E_None != osl::FileBase::getSystemPathFromFileURL(aOutFile, aDisplayedName))
+                        aDisplayedName = aOutFile;
+                    std::cout << "Writing sheet " << OUStringToOString(sTabName, osl_getThreadTextEncoding()) << " -> "
+                                                  << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
+                                                  << std::endl;
+
+                    if (FStatHelper::IsDocument(aOutFile))
+                        std::cout << "Overwriting: " << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
+                                                     << std::endl ;
+                }
+
+                std::unique_ptr<SvStream> xStm = ::utl::UcbStreamHelper::CreateStream(aOutFile, StreamMode::TRUNC | StreamMode::WRITE);
+                if (!xStm)
+                {
+                    SetError(ERRCODE_IO_CANTCREATE);
+                    bRet = false;
+                    break;
+                }
+                AsciiSave(*xStm, aOptions, i);
+            }
+        }
+        else
+        {
+            SvStream* pStream = rMed.GetOutStream();
+            if (pStream)
+            {
+                AsciiSave(*pStream, aOptions, GetSaveTab());
+                bRet = true;
+
+                if (m_aDocument.GetTableCount() > 1)
+                    if (!rMed.GetError())
+                        rMed.SetError(SCWARN_EXPORT_ASCII);
+            }
+         }
+     }
+     else if (aFltName == pFilterDBase)
+diff --git a/sc/source/ui/inc/docsh.hxx b/sc/source/ui/inc/docsh.hxx
+index a519f4c87d04..6a075ff6dade 100644
+--- a/sc/source/ui/inc/docsh.hxx
+++ b/sc/source/ui/inc/docsh.hxx
+@@ -230,7 +230,7 @@ public:
+ 
+     ScDrawLayer*    MakeDrawLayer();
+ 
+-    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt );
+    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt, SCTAB nTab );
+ 
+     void            Execute( SfxRequest& rReq );
+     void            GetState( SfxItemSet &rSet );
+diff --git a/sc/source/ui/inc/imoptdlg.hxx b/sc/source/ui/inc/imoptdlg.hxx
+index bac941c2a377..382067d67813 100644
+--- a/sc/source/ui/inc/imoptdlg.hxx
+++ b/sc/source/ui/inc/imoptdlg.hxx
+@@ -32,7 +32,8 @@ public:
+         ScImportOptions( sal_Unicode nFieldSep, sal_Unicode nTextSep, rtl_TextEncoding nEnc )
+             : nFieldSepCode(nFieldSep), nTextSepCode(nTextSep),
+             bFixedWidth(false), bSaveAsShown(false), bQuoteAllText(false),
+-            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false)
+            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false),
+            nSheetToExport(0)
+         { SetTextEncoding( nEnc ); }
+ 
+     ScImportOptions& operator=( const ScImportOptions& rCpy ) = default;
+@@ -51,6 +52,9 @@ public:
+     bool        bSaveNumberAsSuch;
+     bool        bSaveFormulas;
+     bool        bRemoveSpace;
+    // "0" for 'current sheet', "-1" for all sheets (each to a separate file),
+    // or 1-based specific sheet number (to a separate file).
+    sal_Int32   nSheetToExport;
+ };
+ 
+ #endif // INCLUDED_SC_SOURCE_UI_INC_IMOPTDLG_HXX
+diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx
+index 5d00d39bd837..4e4e74a 100644
+--- a/sfx2/source/doc/docfile.cxx
+++ b/sfx2/source/doc/docfile.cxx
+@@ -328,6 +328,8 @@ public:
+ 
+     util::DateTime m_aDateTime;
+ 
+    uno::Sequence<beans::PropertyValue> m_aArgs;
+
+     explicit SfxMedium_Impl();
+     ~SfxMedium_Impl();
+     SfxMedium_Impl(const SfxMedium_Impl&) = delete;
+@@ -3240,6 +3242,7 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
+     SfxAllItemSet *pParams = new SfxAllItemSet( SfxGetpApp()->GetPool() );
+     pImpl->m_pSet.reset( pParams );
+     TransformParameters( SID_OPENDOC, aArgs, *pParams );
+    SetArgs(aArgs);
+ 
+     OUString aFilterProvider, aFilterName;
+     {
+@@ -3301,6 +3304,16 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
+     Init_Impl();
+ }
+ 
+void SfxMedium::SetArgs(const uno::Sequence<beans::PropertyValue>& rArgs)
+{
+    pImpl->m_aArgs = rArgs;
+    comphelper::SequenceAsHashMap aArgsMap(rArgs);
+    aArgsMap.erase("Stream");
+    aArgsMap.erase("InputStream");
+    pImpl->m_aArgs = aArgsMap.getAsConstPropertyValueList();
+}
+
+uno::Sequence<beans::PropertyValue> SfxMedium::GetArgs() const { return pImpl->m_aArgs; }
+ 
+ SfxMedium::SfxMedium( const uno::Reference < embed::XStorage >& rStor, const OUString& rBaseURL, const std::shared_ptr<SfxItemSet>& p ) :
+     pImpl(new SfxMedium_Impl)
+-- 
+2.31.1
+
--- a/SOURCES/0001-tdf-137209-unparent-widgets-in-fragment-dtor.patch
+++ b/SOURCES/0001-tdf-137209-unparent-widgets-in-fragment-dtor.patch
@ -0,0 +1,44 @@
+From 96fc7531331f45a314416000150b1141e5686f38 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 2 Oct 2020 16:21:02 +0100
+Subject: [PATCH] tdf#137209 unparent widgets in fragment dtor
+
+Change-Id: I819514fd2b97e2cc8daad71a7f3b0b27afe6136d
+---
+ sw/source/ui/dbui/createaddresslistdialog.cxx | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sw/source/ui/dbui/createaddresslistdialog.cxx b/sw/source/ui/dbui/createaddresslistdialog.cxx
+index ae4d354ea29d..994a6045cea5 100644
+--- a/sw/source/ui/dbui/createaddresslistdialog.cxx
+++ b/sw/source/ui/dbui/createaddresslistdialog.cxx
+@@ -53,11 +53,13 @@ struct SwAddressFragment
+     std::unique_ptr<weld::Builder> m_xBuilder;
+     std::unique_ptr<weld::Label> m_xLabel;
+     std::unique_ptr<weld::Entry> m_xEntry;
+    weld::Container* m_pGrid;
+ 
+     SwAddressFragment(weld::Container* pGrid, int nLine)
+         : m_xBuilder(Application::CreateBuilder(pGrid, "modules/swriter/ui/addressfragment.ui"))
+         , m_xLabel(m_xBuilder->weld_label("label"))
+         , m_xEntry(m_xBuilder->weld_entry("entry"))
+        , m_pGrid(pGrid)
+     {
+         m_xLabel->set_grid_left_attach(0);
+         m_xLabel->set_grid_top_attach(nLine);
+@@ -65,6 +67,12 @@ struct SwAddressFragment
+         m_xEntry->set_grid_left_attach(1);
+         m_xEntry->set_grid_top_attach(nLine);
+     }
+
+    virtual ~SwAddressFragment()
+    {
+        m_pGrid->move(m_xEntry.get(), nullptr);
+        m_pGrid->move(m_xLabel.get(), nullptr);
+    }
+ };
+ 
+ class SwAddressControl_Impl
+-- 
+2.26.2
+
--- a/SOURCES/0001-use-gdk_wayland_window_set_application_id-when-it-be.patch
+++ b/SOURCES/0001-use-gdk_wayland_window_set_application_id-when-it-be.patch
@ -0,0 +1,144 @@
+From f1cace2cd06b20fc1431f15892a4293fa3601b39 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 8 Jul 2020 10:13:26 +0100
+Subject: [PATCH] use gdk_wayland_window_set_application_id when it becomes
+ available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I60775dcbfbc396f195a71f219668944d0bfecf31
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/98325
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 2d8e2813ddc87f7ce03b97e4d603df11613461f0)
+
+gdk_wayland_window_set_application_id doesn't work when called early
+
+after mapped it definitely works
+
+Change-Id: Ide0fa636ee26acea0d938aef08532b9396fe901a
+---
+ vcl/inc/unx/gtk/gtkframe.hxx  |  3 +++
+ vcl/unx/gtk3/gtk3gtkframe.cxx | 49 +++++++++++++++++++++++++++++------
+ 2 files changed, 44 insertions(+), 8 deletions(-)
+
+diff --git a/vcl/inc/unx/gtk/gtkframe.hxx b/vcl/inc/unx/gtk/gtkframe.hxx
+index ccf9064..49b6937 100644
+--- a/vcl/inc/unx/gtk/gtkframe.hxx
+++ b/vcl/inc/unx/gtk/gtkframe.hxx
+@@ -206,6 +206,7 @@ class GtkSalFrame : public SalFrame
+     GtkDropTarget*                  m_pDropTarget;
+     GtkDragSource*                  m_pDragSource;
+     bool                            m_bGeometryIsProvisional;
+    bool                            m_bIconSetWhileUnmapped;
+ 
+     GtkSalMenu*                     m_pSalMenu;
+ 
+@@ -315,6 +316,8 @@ class GtkSalFrame : public SalFrame
+ 
+     void SetScreen( unsigned int nNewScreen, SetType eType, tools::Rectangle const *pSize = nullptr );
+ 
+    void SetIcon(const char* pIcon);
+
+ public:
+     cairo_surface_t*                m_pSurface;
+     basegfx::B2IVector              m_aFrameSize;
+diff --git a/vcl/unx/gtk3/gtk3gtkframe.cxx b/vcl/unx/gtk3/gtk3gtkframe.cxx
+index 786aa40..624c75a 100644
+--- a/vcl/unx/gtk3/gtk3gtkframe.cxx
+++ b/vcl/unx/gtk3/gtk3gtkframe.cxx
+@@ -55,6 +55,7 @@
+ 
+ #include <cstdlib>
+ #include <cmath>
+#include <dlfcn.h>
+ 
+ #include <com/sun/star/accessibility/XAccessibleEditableText.hpp>
+ #include <com/sun/star/awt/MouseButton.hpp>
+@@ -922,6 +923,7 @@ void GtkSalFrame::InitCommon()
+     m_pDropTarget       = nullptr;
+     m_pDragSource       = nullptr;
+     m_bGeometryIsProvisional = false;
+    m_bIconSetWhileUnmapped = false;
+     m_ePointerStyle     = static_cast<PointerStyle>(0xffff);
+     m_pSalMenu          = nullptr;
+     m_nWatcherId        = 0;
+@@ -1217,6 +1219,28 @@ void GtkSalFrame::SetTitle( const OUString& rTitle )
+     }
+ }
+ 
+void GtkSalFrame::SetIcon(const char* appicon)
+{
+    gtk_window_set_icon_name(GTK_WINDOW(m_pWindow), appicon);
+
+#if defined(GDK_WINDOWING_WAYLAND)
+    if (DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()))
+    {
+        static auto set_application_id = reinterpret_cast<void (*) (GdkWindow*, const char*)>(
+                                             dlsym(nullptr, "gdk_wayland_window_set_application_id"));
+        if (set_application_id)
+        {
+            GdkWindow* gdkWindow = gtk_widget_get_window(m_pWindow);
+            set_application_id(gdkWindow, appicon);
+
+            // gdk_wayland_window_set_application_id doesn't seem to work before
+            // the window is mapped, so set this for real when/if we are mapped
+            m_bIconSetWhileUnmapped = !gtk_widget_get_mapped(m_pWindow);
+        }
+    }
+#endif
+}
+
+ void GtkSalFrame::SetIcon( sal_uInt16 nIcon )
+ {
+     if( (m_nStyle & (SalFrameStyleFlags::PLUG|SalFrameStyleFlags::SYSTEMCHILD|SalFrameStyleFlags::FLOAT|SalFrameStyleFlags::INTRO|SalFrameStyleFlags::OWNERDRAWDECORATION))
+@@ -1240,7 +1264,8 @@ void GtkSalFrame::SetIcon( sal_uInt16 nIcon )
+     else
+         appicon = g_strdup ("libreoffice-startcenter");
+ 
+-    gtk_window_set_icon_name (GTK_WINDOW (m_pWindow), appicon);
+    SetIcon(appicon);
+
+     g_free (appicon);
+ }
+ 
+@@ -1309,13 +1334,18 @@ void GtkSalFrame::Show( bool bVisible, bool /*bNoActivate*/ )
+             }
+ 
+ #if defined(GDK_WINDOWING_WAYLAND)
+-            //rhbz#1334915, gnome#779143, tdf#100158
+-            //gtk under wayland lacks a way to change the app_id
+-            //of a window, so brute force everything as a
+-            //startcenter when initially shown to at least get
+-            //the default LibreOffice icon and not the broken
+-            //app icon
+-            if (DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()))
+            /*
+             rhbz#1334915, gnome#779143, tdf#100158
+             https://gitlab.gnome.org/GNOME/gtk/-/issues/767
+
+             before gdk_wayland_window_set_application_id was available gtk
+             under wayland lacked a way to change the app_id of a window, so
+             brute force everything as a startcenter when initially shown to at
+             least get the default LibreOffice icon and not the broken app icon
+            */
+            static bool bAppIdImmutable = DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()) &&
+                                          !dlsym(nullptr, "gdk_wayland_window_set_application_id");
+            if (bAppIdImmutable)
+             {
+                 OString sOrigName(g_get_prgname());
+                 g_set_prgname("libreoffice-startcenter");
+@@ -3039,6 +3069,9 @@ gboolean GtkSalFrame::signalMap(GtkWidget *, GdkEvent*, gpointer frame)
+ {
+     GtkSalFrame* pThis = static_cast<GtkSalFrame*>(frame);
+ 
+    if (pThis->m_bIconSetWhileUnmapped)
+        pThis->SetIcon(gtk_window_get_icon_name(GTK_WINDOW(pThis->m_pWindow)));
+
+     pThis->CallCallbackExc( SalEvent::Resize, nullptr );
+     pThis->TriggerPaintEvent();
+ 
+-- 
+2.26.2
+
--- a/SOURCES/0002-CVE-2021-25635.patch
+++ b/SOURCES/0002-CVE-2021-25635.patch
@ -0,0 +1,56 @@
+From a9102a384893fd084011e8451867071452031ece Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 8 Feb 2021 17:05:28 +0000
+Subject: [PATCH 2/6] CVE-2021-25635
+
+default to CertificateValidity::INVALID
+
+so if CertGetCertificateChain fails we don't want validity to be
+css::security::CertificateValidity::VALID which is what the old default
+of 0 equates to
+
+notably
+
+commit 1e0bc66d16aee28ce8bd9582ea32178c63841902
+Date:   Thu Nov 5 16:55:26 2009 +0100
+
+    jl137:  #103420# better logging
+
+turned the nss equivalent of SecurityEnvironment_NssImpl::verifyCertificate
+from 0 to CertificateValidity::INVALID like this change does
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110561
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit edeb164c1d8ab64116afee4e2140403a362a1358)
+
+Change-Id: I5350dbc22d1b9b378da2976d3b0abd728f1f4c27
+---
+ .../source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+index d9b657891b96..4031df289f44 100644
+--- a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+++ b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+@@ -755,7 +755,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
+     const uno::Reference< css::security::XCertificate >& aCert,
+     const uno::Sequence< uno::Reference< css::security::XCertificate > >& seqCerts)
+ {
+-    sal_Int32 validity = 0;
+    sal_Int32 validity = css::security::CertificateValidity::INVALID;
+     PCCERT_CHAIN_CONTEXT pChainContext = nullptr;
+     PCCERT_CONTEXT pCertContext = nullptr;
+ 
+@@ -899,7 +899,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
+         }
+         else
+         {
+-            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChaine failed.");
+            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChain failed.");
+         }
+     }
+ 
+-- 
+2.32.0
+
--- a/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
+++ b/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
@ -0,0 +1,198 @@
+From 61f8673fb44150bd629d88f6626aff8d5b026449 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 21 Mar 2022 20:58:34 +0000
+Subject: [PATCH] make hash encoding match decoding
+
+Seeing as old versions of the hash may be in the users config, add a
+StorageVersion field to the office config Passwords section which
+defaults to 0 to indicate the old hash is in use.
+
+Try the old varient when StorageVersion is 0. When a new encoded master
+password it set write StorageVersion of 1 to indicate a new hash is in
+use and use the new style when StorageVersion is 1.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)
+
+svl: fix crash if user cancels/closes master password dialog
+
+(regression from d7ba5614d90381d68f880ca7e7c5ef8bbb1b1c43)
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133932
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit bbb8617ece6d946957c2eb96287081029bce530f)
+
+Change-Id: I3174c37a5891bfc849984e0ec5c2c392b9c6e7b1
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133905
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ .../schema/org/openoffice/Office/Common.xcs   |  6 +++
+ .../passwordcontainer/passwordcontainer.cxx   | 47 ++++++++++++++++++-
+ .../passwordcontainer/passwordcontainer.hxx   |  6 +++
+ uui/source/iahndl-authentication.cxx          |  5 +-
+ 4 files changed, 60 insertions(+), 4 deletions(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index b317f616deeb..b033b29b60d7 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -911,6 +911,12 @@
+         </info>
+         <value>false</value>
+       </prop>
+      <prop oor:name="StorageVersion" oor:type="xs:int" oor:nillable="false">
+        <info>
+          <desc>Specifies what version of encoding scheme the password container uses.</desc>
+        </info>
+        <value>0</value>
+      </prop>
+       <prop oor:name="HasMaster" oor:type="xs:boolean" oor:nillable="false">
+         <info>
+           <desc>Specifies if there is a valid master password.</desc>
+diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
+index 02947cd3892c..ff0b40df4016 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.cxx
+++ b/svl/source/passwordcontainer/passwordcontainer.cxx
+@@ -17,6 +17,8 @@
+  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
+  */
+ 
+#include <sal/config.h>
+#include <sal/log.hxx>
+ 
+ #include "passwordcontainer.hxx"
+ 
+@@ -259,6 +261,23 @@ bool StorageItem::useStorage()
+     return aResult;
+ }
+ 
+sal_Int32 StorageItem::getStorageVersion()
+{
+    Sequence<OUString> aNodeNames { "StorageVersion" };
+
+    Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
+
+    if( aPropertyValues.getLength() != aNodeNames.getLength() )
+    {
+        OSL_FAIL( "Problems during reading" );
+        return 0;
+    }
+
+    sal_Int32 nResult = 0;
+    aPropertyValues[0] >>= nResult;
+
+    return nResult;
+}
+ 
+ bool StorageItem::getEncodedMP( OUString& aResult )
+ {
+@@ -291,15 +310,17 @@ bool StorageItem::getEncodedMP( OUString& aResult )
+ 
+ void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
+ {
+-    Sequence< OUString > sendNames(2);
+-    Sequence< uno::Any > sendVals(2);
+    Sequence< OUString > sendNames(3);
+    Sequence< uno::Any > sendVals(3);
+ 
+     sendNames[0] = "HasMaster";
+     sendNames[1] = "Master";
+    sendNames[2] = "StorageVersion";
+ 
+     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
+     sendVals[0] <<= bHasMaster;
+     sendVals[1] <<= aEncoded;
+    sendVals[2] <<= nCurrentStorageVersion;
+ 
+     ConfigItem::SetModified();
+     ConfigItem::PutProperties( sendNames, sendVals );
+@@ -800,6 +821,18 @@ OUString PasswordContainer::RequestPasswordFromUser( PasswordRequestMode aRMode,
+     return aResult;
+ }
+ 
+// Mangle the key to match an old bug
+static OUString ReencodeAsOldHash(const OUString& rPass)
+{
+    OUStringBuffer aBuffer;
+    for (int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ++ind)
+    {
+        unsigned char i = static_cast<char>(rPass.copy(ind * 2, 2).toUInt32(16));
+        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
+        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
+    }
+    return aBuffer.makeStringAndClear();
+}
+ 
+ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInteractionHandler >& aHandler )
+ {
+@@ -838,6 +871,9 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+                     }
+                     else
+                     {
+                        if (m_pStorageFile->getStorageVersion() == 0)
+                            aPass = ReencodeAsOldHash(aPass);
+
+                         std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
+                         if( aRM.empty() || aPass != aRM[0] )
+                         {
+@@ -1042,6 +1078,13 @@ sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::R
+ 
+                 do {
+                     aPass = RequestPasswordFromUser( aRMode, xTmpHandler );
+
+
+                    if (!aPass.isEmpty() && m_pStorageFile->getStorageVersion() == 0)
+                    {
+                        aPass = ReencodeAsOldHash(aPass);
+                    }
+
+                     bResult = ( !aPass.isEmpty() && aPass == m_aMasterPasswd );
+                     aRMode = PasswordRequestMode_PASSWORD_REENTER; // further questions with error notification
+                 } while( !bResult && !aPass.isEmpty() );
+diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
+index 09fb7e03629d..cf5c717d0c9e 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.hxx
+++ b/svl/source/passwordcontainer/passwordcontainer.hxx
+@@ -167,6 +167,10 @@ public:
+ typedef ::std::pair< const OUString, ::std::vector< NamePassRecord > > PairUrlRecord;
+ typedef ::std::map< OUString, ::std::vector< NamePassRecord > > PassMap;
+ 
+// org.openoffice.Office.Common/Passwords/StorageVersion bump if details of
+// how password details are saved changes. Enables migration from previous
+// schemes.
+constexpr sal_Int32 nCurrentStorageVersion = 1;
+ 
+ class PasswordContainer;
+ 
+@@ -195,6 +199,8 @@ public:
+     void remove( const OUString& url, const OUString& rec );
+     void clear();
+ 
+    sal_Int32 getStorageVersion();
+
+     bool getEncodedMP( OUString& aResult );
+     void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
+     void setUseStorage( bool bUse );
+diff --git a/uui/source/iahndl-authentication.cxx b/uui/source/iahndl-authentication.cxx
+index 4835a485dd2a..5764e62cb1c6 100644
+--- a/uui/source/iahndl-authentication.cxx
+++ b/uui/source/iahndl-authentication.cxx
+@@ -436,8 +436,9 @@ executeMasterPasswordDialog(
+     OUStringBuffer aBuffer;
+     for (sal_uInt8 i : aKey)
+     {
+-        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
+-        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
+        // match PasswordContainer::DecodePasswords aMasterPasswd.copy(index * 2, 2).toUInt32(16));
+        aBuffer.append(OUString::number(i >> 4, 16));
+        aBuffer.append(OUString::number(i & 15, 16));
+     }
+     rInfo.SetPassword(aBuffer.makeStringAndClear());
+ }
+-- 
+2.37.1
+
--- a/SOURCES/0002-resource-leak.patch
+++ b/SOURCES/0002-resource-leak.patch
@ -0,0 +1,25 @@
+From abaf73f99c300ffe6c38dc7d1ce93ab09043f88a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 4 Nov 2020 11:02:21 +0000
+Subject: [PATCH 2/8] resource leak
+
+Change-Id: I1abd8acef55d5bdb4744ecf1a62d8e1396de0e3f
+---
+ vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx b/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
+index 52f0a34cd3a2..483283cadab5 100644
+--- a/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
+++ b/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
+@@ -987,6 +987,7 @@ TabStopList2String( const uno::Any& rAny, bool default_tabs )
+             {
+                 gchar * old_tab_str = ret;
+                 ret = g_strconcat(old_tab_str, " ", tab_str, nullptr);
+                g_free( tab_str );
+                 g_free( old_tab_str );
+             }
+             else
+-- 
+2.28.0
+
--- a/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
+++ b/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
@ -0,0 +1,586 @@
+From a3046cfa58bdfa2a1b9ea6287a021230830f056f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 22 Mar 2022 17:22:22 +0000
+Subject: [PATCH] add Initialization Vectors to password storage
+
+old ones default to the current all zero case and continue to work
+as before
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131974
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 192fa1e3bfc6269f2ebb91716471485a56074aea)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132306
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+(cherry picked from commit ab77587ec300f5c30084471000663c46ddf25dad)
+
+Change-Id: I6fe3b02fafcce1b5e7133e77e76a5118177d77af
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133907
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ .../schema/org/openoffice/Office/Common.xcs   |  10 ++
+ .../passwordcontainer/passwordcontainer.cxx   | 127 ++++++++++++------
+ .../passwordcontainer/passwordcontainer.hxx   |  63 +++++++--
+ 3 files changed, 151 insertions(+), 49 deletions(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index b033b29b60d7..e57d26ab3366 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -27,6 +27,11 @@
+       <info>
+         <desc>Contains a container for passwords.</desc>
+       </info>
+      <prop oor:name="InitializationVector" oor:type="xs:string">
+        <info>
+          <desc>Contains an initialization vector for the password encryption.</desc>
+        </info>
+      </prop>
+       <prop oor:name="Password" oor:type="xs:string" oor:localized="false">
+         <info>
+           <desc>Contains a password encoded with the master password.</desc>
+@@ -923,6 +928,11 @@
+         </info>
+         <value>false</value>
+       </prop>
+      <prop oor:name="MasterInitializationVector" oor:type="xs:string">
+        <info>
+          <desc>Contains an initialization vector for the master password encryption.</desc>
+        </info>
+      </prop>
+       <prop oor:name="Master" oor:type="xs:string" oor:nillable="false">
+         <info>
+           <desc>Contains the master password encrypted by itself.</desc>
+diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
+index ff0b40df4016..380188ef495c 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.cxx
+++ b/svl/source/passwordcontainer/passwordcontainer.cxx
+@@ -184,15 +184,18 @@ PassMap StorageItem::getInfo()
+ 
+     Sequence< OUString > aNodeNames     = ConfigItem::GetNodeNames( "Store" );
+     sal_Int32 aNodeCount = aNodeNames.getLength();
+-    Sequence< OUString > aPropNames( aNodeCount );
+    Sequence< OUString > aPropNames( aNodeCount * 2);
+ 
+     std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.begin(),
+         [](const OUString& rName) -> OUString {
+             return "Store/Passwordstorage['" + rName + "']/Password"; });
+    std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.getArray() + aNodeCount,
+        [](const OUString& rName) -> OUString {
+            return "Store/Passwordstorage['" + rName + "']/InitializationVector"; });
+ 
+     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aPropNames );
+ 
+-    if( aPropertyValues.getLength() != aNodeCount )
+    if( aPropertyValues.getLength() != aNodeCount * 2)
+     {
+         OSL_FAIL( "Problems during reading" );
+         return aResult;
+@@ -208,14 +211,16 @@ PassMap StorageItem::getInfo()
+             OUString aName = aUrlUsr[1];
+ 
+             OUString aEPasswd;
+            OUString aIV;
+             aPropertyValues[aNodeInd] >>= aEPasswd;
+            aPropertyValues[aNodeInd + aNodeCount] >>= aIV;
+ 
+             PassMap::iterator aIter = aResult.find( aUrl );
+             if( aIter != aResult.end() )
+-                aIter->second.emplace_back( aName, aEPasswd );
+                aIter->second.emplace_back( aName, aEPasswd, aIV );
+             else
+             {
+-                NamePassRecord aNewRecord( aName, aEPasswd );
+                NamePassRecord aNewRecord( aName, aEPasswd, aIV );
+                 std::vector< NamePassRecord > listToAdd( 1, aNewRecord );
+ 
+                 aResult.insert( PairUrlRecord( aUrl, listToAdd ) );
+@@ -279,17 +284,19 @@ sal_Int32 StorageItem::getStorageVersion()
+     return nResult;
+ }
+ 
+-bool StorageItem::getEncodedMP( OUString& aResult )
+bool StorageItem::getEncodedMP( OUString& aResult, OUString& aResultIV )
+ {
+     if( hasEncoded )
+     {
+         aResult = mEncoded;
+        aResultIV = mEncodedIV;
+         return true;
+     }
+ 
+-    Sequence< OUString > aNodeNames( 2 );
+    Sequence< OUString > aNodeNames( 3 );
+     aNodeNames[0] = "HasMaster";
+     aNodeNames[1] = "Master";
+    aNodeNames[2] = "MasterInitializationVector";
+ 
+     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
+ 
+@@ -301,32 +308,37 @@ bool StorageItem::getEncodedMP( OUString& aResult )
+ 
+     aPropertyValues[0] >>= hasEncoded;
+     aPropertyValues[1] >>= mEncoded;
+    aPropertyValues[2] >>= mEncodedIV;
+ 
+     aResult = mEncoded;
+    aResultIV = mEncodedIV;
+ 
+     return hasEncoded;
+ }
+ 
+ 
+-void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
+void StorageItem::setEncodedMP( const OUString& aEncoded, const OUString& aEncodedIV, bool bAcceptEmpty )
+ {
+-    Sequence< OUString > sendNames(3);
+-    Sequence< uno::Any > sendVals(3);
+    Sequence< OUString > sendNames(4);
+    Sequence< uno::Any > sendVals(4);
+ 
+     sendNames[0] = "HasMaster";
+     sendNames[1] = "Master";
+-    sendNames[2] = "StorageVersion";
+    sendNames[2] = "MasterInitializationVector";
+    sendNames[3] = "StorageVersion";
+ 
+     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
+     sendVals[0] <<= bHasMaster;
+     sendVals[1] <<= aEncoded;
+-    sendVals[2] <<= nCurrentStorageVersion;
+    sendVals[2] <<= aEncodedIV;
+    sendVals[3] <<= nCurrentStorageVersion;
+ 
+     ConfigItem::SetModified();
+     ConfigItem::PutProperties( sendNames, sendVals );
+ 
+     hasEncoded = bHasMaster;
+     mEncoded = aEncoded;
+    mEncodedIV = aEncodedIV;
+ }
+ 
+ 
+@@ -362,11 +374,13 @@ void StorageItem::update( const OUString& aURL, const NamePassRecord& aRecord )
+     forIndex.push_back( aURL );
+     forIndex.push_back( aRecord.GetUserName() );
+ 
+-    Sequence< beans::PropertyValue > sendSeq(1);
+    Sequence< beans::PropertyValue > sendSeq(2);
+ 
+-    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
+    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( { aURL, aRecord.GetUserName() } ) + "']/InitializationVector";
+    sendSeq[0].Value <<= aRecord.GetPersistentIV();
+ 
+-    sendSeq[0].Value <<= aRecord.GetPersPasswords();
+    sendSeq[1].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
+    sendSeq[1].Value <<= aRecord.GetPersPasswords();
+ 
+     ConfigItem::SetModified();
+     ConfigItem::SetSetProperties( "Store", sendSeq );
+@@ -427,7 +441,7 @@ void SAL_CALL PasswordContainer::disposing( const EventObject& )
+     }
+ }
+ 
+-std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
+std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
+ {
+     if( !aMasterPasswd.isEmpty() )
+     {
+@@ -442,9 +456,16 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
+             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
+ 
+            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
+            if (!aIV.isEmpty())
+            {
+                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
+            }
+
+             rtlCipherError result = rtl_cipher_init (
+                     aDecoder, rtl_Cipher_DirectionDecode,
+-                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
+                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
+ 
+             if( result == rtl_Cipher_E_None )
+             {
+@@ -477,7 +498,7 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
+         "Can't decode!", css::uno::Reference<css::uno::XInterface>(), mode);
+ }
+ 
+-OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPasswd )
+OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPasswd)
+ {
+     if( !aMasterPasswd.isEmpty() )
+     {
+@@ -494,9 +515,16 @@ OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines
+             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
+ 
+            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
+            if (!aIV.isEmpty())
+            {
+                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
+            }
+
+             rtlCipherError result = rtl_cipher_init (
+                     aEncoder, rtl_Cipher_DirectionEncode,
+-                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
+                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
+ 
+             if( result == rtl_Cipher_E_None )
+             {
+@@ -564,7 +592,7 @@ void PasswordContainer::UpdateVector( const OUString& aURL, std::vector< NamePas
+ 
+             if( aRecord.HasPasswords( PERSISTENT_RECORD ) )
+             {
+-                aNPIter.SetPersPasswords( aRecord.GetPersPasswords() );
+                aNPIter.SetPersPasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV() );
+ 
+                 if( writeFile )
+                 {
+@@ -597,7 +625,8 @@ UserRecord PasswordContainer::CopyToUserRecord( const NamePassRecord& aRecord, b
+     {
+         try
+         {
+-            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
+            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV(),
+                                                                           GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
+             aPasswords.insert( aPasswords.end(), aDecodedPasswords.begin(), aDecodedPasswords.end() );
+         }
+         catch( NoMasterException& )
+@@ -642,6 +671,19 @@ void SAL_CALL PasswordContainer::addPersistent( const OUString& Url, const OUStr
+     PrivateAdd( Url, UserName, Passwords, PERSISTENT_RECORD, aHandler );
+ }
+ 
+OUString PasswordContainer::createIV()
+{
+    rtlRandomPool randomPool = mRandomPool.get();
+    unsigned char iv[RTL_DIGEST_LENGTH_MD5];
+    rtl_random_getBytes(randomPool, iv, RTL_DIGEST_LENGTH_MD5);
+    OUStringBuffer aBuffer;
+    for (sal_uInt8 i : iv)
+    {
+        aBuffer.append(OUString::number(i >> 4, 16));
+        aBuffer.append(OUString::number(i & 15, 16));
+    }
+    return aBuffer.makeStringAndClear();
+}
+ 
+ void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserName, const Sequence< OUString >& Passwords, char Mode, const Reference< XInteractionHandler >& aHandler )
+ {
+@@ -649,7 +691,11 @@ void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserNam
+     ::std::vector< OUString > aStorePass = comphelper::sequenceToContainer< std::vector<OUString> >( Passwords );
+ 
+     if( Mode == PERSISTENT_RECORD )
+-        aRecord.SetPersPasswords( EncodePasswords( aStorePass, GetMasterPassword( aHandler ) ) );
+    {
+        OUString sIV = createIV();
+        OUString sEncodedPasswords = EncodePasswords( aStorePass, sIV, GetMasterPassword( aHandler ) );
+        aRecord.SetPersPasswords( sEncodedPasswords, sIV );
+    }
+     else if( Mode == MEMORY_RECORD )
+         aRecord.SetMemPasswords( aStorePass );
+     else
+@@ -842,10 +888,10 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+ 
+     if( m_aMasterPasswd.isEmpty() && aHandler.is() )
+     {
+-        OUString aEncodedMP;
+        OUString aEncodedMP, aEncodedMPIV;
+         bool bDefaultPassword = false;
+ 
+-        if( !m_pStorageFile->getEncodedMP( aEncodedMP ) )
+        if( !m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+             aRMode = PasswordRequestMode_PASSWORD_CREATE;
+         else if ( aEncodedMP.isEmpty() )
+         {
+@@ -867,14 +913,15 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+                         m_aMasterPasswd = aPass;
+                         std::vector< OUString > aMaster( 1, m_aMasterPasswd );
+ 
+-                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
+                        OUString sIV = createIV();
+                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, sIV, m_aMasterPasswd ), sIV );
+                     }
+                     else
+                     {
+                         if (m_pStorageFile->getStorageVersion() == 0)
+                             aPass = ReencodeAsOldHash(aPass);
+ 
+-                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
+                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aEncodedMPIV, aPass, aRMode ) );
+                         if( aRM.empty() || aPass != aRM[0] )
+                         {
+                             bAskAgain = true;
+@@ -1031,7 +1078,8 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
+             {
+                 sal_Int32 oldLen = aUsers.getLength();
+                 aUsers.realloc( oldLen + 1 );
+-                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
+                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), aNP.GetPersistentIV(),
+                                                                                                                    GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
+             }
+ 
+         if( aUsers.hasElements() )
+@@ -1048,12 +1096,12 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
+ sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::Reference< task::XInteractionHandler >& xHandler )
+ {
+     bool bResult = false;
+-    OUString aEncodedMP;
+    OUString aEncodedMP, aEncodedMPIV;
+     uno::Reference< task::XInteractionHandler > xTmpHandler = xHandler;
+     ::osl::MutexGuard aGuard( mMutex );
+ 
+     // the method should fail if there is no master password
+-    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) )
+    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+     {
+         if ( aEncodedMP.isEmpty() )
+         {
+@@ -1122,8 +1170,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
+ 
+         bool bCanChangePassword = true;
+         // if there is already a stored master password it should be entered by the user before the change happen
+-        OUString aEncodedMP;
+-        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP ) )
+        OUString aEncodedMP, aEncodedMPIV;
+        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
+ 
+         if ( bCanChangePassword )
+@@ -1142,7 +1190,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
+                 // store the new master password
+                 m_aMasterPasswd = aPass;
+                 std::vector< OUString > aMaster( 1, m_aMasterPasswd );
+-                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
+                OUString aIV = createIV();
+                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, aIV, m_aMasterPasswd ), aIV );
+ 
+                 // store all the entries with the new password
+                 for ( const auto& rURL : aPersistent )
+@@ -1167,7 +1216,7 @@ void SAL_CALL PasswordContainer::removeMasterPassword()
+     if ( m_pStorageFile )
+     {
+         m_aMasterPasswd.clear();
+-        m_pStorageFile->setEncodedMP( OUString() ); // let the master password be removed from configuration
+        m_pStorageFile->setEncodedMP( OUString(), OUString() ); // let the master password be removed from configuration
+     }
+ }
+ 
+@@ -1178,8 +1227,8 @@ sal_Bool SAL_CALL PasswordContainer::hasMasterPassword(  )
+     if ( !m_pStorageFile )
+         throw uno::RuntimeException();
+ 
+-    OUString aEncodedMP;
+-    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) );
+    OUString aEncodedMP, aEncodedMPIV;
+    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) );
+ }
+ 
+ sal_Bool SAL_CALL PasswordContainer::allowPersistentStoring( sal_Bool bAllow )
+@@ -1226,8 +1275,8 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
+ 
+         bool bCanChangePassword = true;
+         // if there is already a stored nondefault master password it should be entered by the user before the change happen
+-        OUString aEncodedMP;
+-        if( m_pStorageFile->getEncodedMP( aEncodedMP ) && !aEncodedMP.isEmpty() )
+        OUString aEncodedMP, aEncodedMPIV;
+        if( m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && !aEncodedMP.isEmpty() )
+             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
+ 
+         if ( bCanChangePassword )
+@@ -1244,7 +1293,7 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
+ 
+                 // store the empty string to flag the default master password
+                 m_aMasterPasswd = aPass;
+-                m_pStorageFile->setEncodedMP( OUString(), true );
+                m_pStorageFile->setEncodedMP( OUString(), OUString(), true );
+ 
+                 // store all the entries with the new password
+                 for ( const auto& rURL : aPersistent )
+@@ -1268,8 +1317,8 @@ sal_Bool SAL_CALL PasswordContainer::isDefaultMasterPasswordUsed()
+     if ( !m_pStorageFile )
+         throw uno::RuntimeException();
+ 
+-    OUString aEncodedMP;
+-    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) && aEncodedMP.isEmpty() );
+    OUString aEncodedMP, aEncodedMPIV;
+    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && aEncodedMP.isEmpty() );
+ }
+ 
+ 
+diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
+index cf5c717d0c9e..4e3a6629139e 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.hxx
+++ b/svl/source/passwordcontainer/passwordcontainer.hxx
+@@ -33,6 +33,7 @@
+ #include <unotools/configitem.hxx>
+ #include <ucbhelper/interactionrequest.hxx>
+ 
+#include <rtl/random.h>
+ #include <rtl/ref.hxx>
+ #include <osl/mutex.hxx>
+ 
+@@ -51,11 +52,12 @@ class NamePassRecord
+     ::std::vector< OUString >                      m_aMemPass;
+ 
+     // persistent passwords are encrypted in one string
+-    bool                                                  m_bHasPersPass;
+    bool                                           m_bHasPersPass;
+     OUString                                       m_aPersPass;
+    OUString                                       m_aPersistentIV;
+ 
+     void InitArrays( bool bHasMemoryList, const ::std::vector< OUString >& aMemoryList,
+-                     bool bHasPersistentList, const OUString& aPersistentList )
+                     bool bHasPersistentList, const OUString& aPersistentList, const OUString& aPersistentIV )
+     {
+         m_bHasMemPass = bHasMemoryList;
+         if ( bHasMemoryList )
+@@ -63,7 +65,10 @@ class NamePassRecord
+ 
+         m_bHasPersPass = bHasPersistentList;
+         if ( bHasPersistentList )
+        {
+             m_aPersPass = aPersistentList;
+            m_aPersistentIV = aPersistentIV;
+        }
+     }
+ 
+ public:
+@@ -75,11 +80,12 @@ public:
+     {
+     }
+ 
+-    NamePassRecord( const OUString& aName, const OUString& aPersistentList )
+    NamePassRecord( const OUString& aName, const OUString& aPersistentList, const OUString& aPersistentIV )
+         : m_aName( aName )
+         , m_bHasMemPass( false )
+         , m_bHasPersPass( true )
+         , m_aPersPass( aPersistentList )
+        , m_aPersistentIV( aPersistentIV )
+     {
+     }
+ 
+@@ -88,7 +94,8 @@ public:
+         , m_bHasMemPass( false )
+         , m_bHasPersPass( false )
+     {
+-        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
+        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
+                    aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
+     }
+ 
+     NamePassRecord& operator=( const NamePassRecord& aRecord )
+@@ -99,7 +106,9 @@ public:
+ 
+             m_aMemPass.clear();
+             m_aPersPass.clear();
+-            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
+            m_aPersistentIV.clear();
+            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
+                        aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
+         }
+         return *this;
+     }
+@@ -135,15 +144,24 @@ public:
+         return OUString();
+     }
+ 
+    OUString GetPersistentIV() const
+    {
+        if ( m_bHasPersPass )
+            return m_aPersistentIV;
+
+        return OUString();
+    }
+
+     void SetMemPasswords( const ::std::vector< OUString >& aMemList )
+     {
+         m_aMemPass = aMemList;
+         m_bHasMemPass = true;
+     }
+ 
+-    void SetPersPasswords( const OUString& aPersList )
+    void SetPersPasswords( const OUString& aPersList, const OUString& aPersIV )
+     {
+         m_aPersPass = aPersList;
+        m_aPersistentIV = aPersIV;
+         m_bHasPersPass = true;
+     }
+ 
+@@ -158,6 +176,7 @@ public:
+         {
+             m_bHasPersPass = false;
+             m_aPersPass.clear();
+            m_aPersistentIV.clear();
+         }
+     }
+ 
+@@ -181,6 +200,7 @@ private:
+     PasswordContainer*     mainCont;
+     bool                   hasEncoded;
+     OUString        mEncoded;
+    OUString        mEncodedIV;
+ 
+     virtual void            ImplCommit() override;
+ 
+@@ -201,8 +221,8 @@ public:
+ 
+     sal_Int32 getStorageVersion();
+ 
+-    bool getEncodedMP( OUString& aResult );
+-    void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
+    bool getEncodedMP( OUString& aResult, OUString& aResultIV );
+    void setEncodedMP( const OUString& aResult, const OUString& aResultIV, bool bAcceptEmpty = false );
+     void setUseStorage( bool bUse );
+     bool useStorage();
+ 
+@@ -223,6 +243,29 @@ private:
+     css::uno::Reference< css::lang::XComponent > mComponent;
+     SysCredentialsConfig mUrlContainer;
+ 
+    class RandomPool
+    {
+    private:
+        rtlRandomPool m_aRandomPool;
+    public:
+        RandomPool() : m_aRandomPool(rtl_random_createPool())
+        {
+        }
+        rtlRandomPool get()
+        {
+            return m_aRandomPool;
+        }
+        ~RandomPool()
+        {
+            // Clean up random pool memory
+            rtl_random_destroyPool(m_aRandomPool);
+        }
+    };
+
+    RandomPool mRandomPool;
+
+    OUString createIV();
+
+     /// @throws css::uno::RuntimeException
+     css::uno::Sequence< css::task::UserRecord > CopyToUserRecordSequence(
+                                         const ::std::vector< NamePassRecord >& original,
+@@ -273,10 +316,10 @@ css::task::UrlRecord find(
+                               const css::uno::Reference< css::task::XInteractionHandler >& Handler );
+ 
+     /// @throws css::uno::RuntimeException
+-    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
+    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
+ 
+     /// @throws css::uno::RuntimeException
+-    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPassword );
+    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPassword );
+ 
+ public:
+     PasswordContainer( const css::uno::Reference< css::lang::XMultiServiceFactory >& );
+-- 
+2.37.1
+
--- a/SOURCES/0003-copy_paste_error-data1-looks-like-a-copy-paste-error.patch
+++ b/SOURCES/0003-copy_paste_error-data1-looks-like-a-copy-paste-error.patch
@ -0,0 +1,37 @@
+From 22eb26fe2f4ecf57bff0e1bb377f7af2e7a9e7e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 4 Nov 2020 09:28:02 +0000
+Subject: [PATCH 3/8] copy_paste_error data1 looks like a copy-paste error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I937743f8d1789c68ed960c6a5aede0508dfa7bcd
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105282
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 1aa5e450f065bfdae8c354344f23b897f48a166f)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105457
+Tested-by: Jean-Pierre Ledure <jp@ledure.be>
+Reviewed-by: Jean-Pierre Ledure <jp@ledure.be>
+(cherry picked from commit 4a6ca8920afc0bbb8e36869416745d5b0163313c)
+---
+ wizards/source/access2base/access2base.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/wizards/source/access2base/access2base.py b/wizards/source/access2base/access2base.py
+index af14a880cb3d..3cdc758e820d 100644
+--- a/wizards/source/access2base/access2base.py
+++ b/wizards/source/access2base/access2base.py
+@@ -902,7 +902,7 @@ class Basic(object, metaclass = _Singleton):
+     @classmethod
+     def DateDiff(cls, add, date1, date2, weekstart = 1, yearstart = 1):
+         if isinstance(date1, datetime.datetime): date1 = date1.isoformat()
+-        if isinstance(date2, datetime.datetime): date2 = date1.isoformat()
+        if isinstance(date2, datetime.datetime): date2 = date2.isoformat()
+         return cls.M('PyDateDiff', _WRAPPERMODULE, add, date1, date2, weekstart, yearstart)
+ 
+     @classmethod
+-- 
+2.28.0
+
--- a/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
+++ b/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
--- a/SOURCES/0004-CVE-2021-25634.patch
+++ b/SOURCES/0004-CVE-2021-25634.patch
@ -0,0 +1,397 @@
+From 9ef423d4e7c85629772131b3216b98e17d7b8d7e Mon Sep 17 00:00:00 2001
+From: Michael Stahl <michael.stahl@allotropia.de>
+Date: Thu, 18 Feb 2021 19:22:31 +0100
+Subject: [PATCH 4/6] CVE-2021-25634
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+xmlsecurity: XSecParser confused about multiple timestamps
+
+LO writes timestamp both to dc:date and xades:SigningTime elements.
+
+The parser tries to avoid reading multiple dc:date, preferring the first
+one, but doesn't care about multiple xades:SigningTime, for undocumented
+reasons.
+
+Ideally something should check all read values for consistency.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111160
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 4ab8d9c09a5873ca0aea56dafa1ab34758d52ef7)
+
+xmlsecurity: remove XSecController::setPropertyId()
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111252
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit d2a345e1163616fe3201ef1d6c758e2e819214e0)
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111908
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit abe77c4fcb9ea97d9fff07eaea6d8863bcba5b02)
+
+Change-Id: Ic018ee89797a1c8a4f870ae102af48006de930ef
+---
+ include/svl/sigstruct.hxx                    |  7 +-
+ xmlsecurity/inc/xsecctl.hxx                  |  5 +-
+ xmlsecurity/source/helper/ooxmlsecparser.cxx |  4 +-
+ xmlsecurity/source/helper/xsecctl.cxx        |  2 +-
+ xmlsecurity/source/helper/xsecparser.cxx     | 81 ++++++++++----------
+ xmlsecurity/source/helper/xsecparser.hxx     |  6 --
+ xmlsecurity/source/helper/xsecsign.cxx       |  4 +-
+ xmlsecurity/source/helper/xsecverify.cxx     | 39 ++++------
+ 8 files changed, 68 insertions(+), 80 deletions(-)
+
+diff --git a/include/svl/sigstruct.hxx b/include/svl/sigstruct.hxx
+index f6ee242c84d1..7a0296fa9fae 100644
+--- a/include/svl/sigstruct.hxx
+++ b/include/svl/sigstruct.hxx
+@@ -103,6 +103,9 @@ struct SignatureInformation
+     // XAdES EncapsulatedX509Certificate values
+     std::set<OUString> maEncapsulatedX509Certificates;
+ 
+    OUString ouSignatureId;
+    // signature may contain multiple time stamps - check they're consistent
+    bool hasInconsistentSigningTime = false;
+     //We also keep the date and time as string. This is done when this
+     //structure is created as a result of a XML signature being read.
+     //When then a signature is added or another removed, then the original
+@@ -115,8 +118,8 @@ struct SignatureInformation
+     //and the converted time is written back, then the string looks different
+     //and the signature is broken.
+     OUString ouDateTime;
+-    OUString ouSignatureId;
+-    OUString ouPropertyId;
+    /// The Id attribute of the <SignatureProperty> element that contains the <dc:date>.
+    OUString ouDateTimePropertyId;
+     /// Characters of the <dc:description> element inside the signature.
+     OUString ouDescription;
+     /// The Id attribute of the <SignatureProperty> element that contains the <dc:description>.
+diff --git a/xmlsecurity/inc/xsecctl.hxx b/xmlsecurity/inc/xsecctl.hxx
+index 351c94a2a3e6..7baa219fb13c 100644
+--- a/xmlsecurity/inc/xsecctl.hxx
+++ b/xmlsecurity/inc/xsecctl.hxx
+@@ -271,8 +271,8 @@ private:
+     void setGpgCertificate( OUString const & ouGpgCert );
+     void setGpgOwner( OUString const & ouGpgOwner );
+ 
+-    void setDate( OUString const & ouDate );
+-    void setDescription(const OUString& rDescription);
+    void setDate(OUString const& rId, OUString const& ouDate);
+    void setDescription(OUString const& rId, OUString const& rDescription);
+     void setCertDigest(const OUString& rCertDigest);
+     void setValidSignatureImage(const OUString& rValidSigImg);
+     void setInvalidSignatureImage(const OUString& rInvalidSigImg);
+@@ -283,7 +283,6 @@ public:
+ 
+ private:
+     void setId( OUString const & ouId );
+-    void setPropertyId( OUString const & ouPropertyId );
+ 
+     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToRead(
+         sal_Int32 nSecurityId );
+diff --git a/xmlsecurity/source/helper/ooxmlsecparser.cxx b/xmlsecurity/source/helper/ooxmlsecparser.cxx
+index c22e8c2261bf..a200de60c07a 100644
+--- a/xmlsecurity/source/helper/ooxmlsecparser.cxx
+++ b/xmlsecurity/source/helper/ooxmlsecparser.cxx
+@@ -192,12 +192,12 @@ void SAL_CALL OOXMLSecParser::endElement(const OUString& rName)
+     }
+     else if (rName == "mdssi:Value")
+     {
+-        m_pXSecController->setDate(m_aMdssiValue);
+        m_pXSecController->setDate("", m_aMdssiValue);
+         m_bInMdssiValue = false;
+     }
+     else if (rName == "SignatureComments")
+     {
+-        m_pXSecController->setDescription(m_aSignatureComments);
+        m_pXSecController->setDescription("", m_aSignatureComments);
+         m_bInSignatureComments = false;
+     }
+     else if (rName == "X509IssuerName")
+diff --git a/xmlsecurity/source/helper/xsecctl.cxx b/xmlsecurity/source/helper/xsecctl.cxx
+index ab108d13c224..8d5ea68c768b 100644
+--- a/xmlsecurity/source/helper/xsecctl.cxx
+++ b/xmlsecurity/source/helper/xsecctl.cxx
+@@ -819,7 +819,7 @@ void XSecController::exportSignature(
+                 pAttributeList = new SvXMLAttributeList();
+                 pAttributeList->AddAttribute(
+                     "Id",
+-                    signatureInfo.ouPropertyId);
+                    signatureInfo.ouDateTimePropertyId);
+                 pAttributeList->AddAttribute(
+                     "Target",
+                     "#" + signatureInfo.ouSignatureId);
+diff --git a/xmlsecurity/source/helper/xsecparser.cxx b/xmlsecurity/source/helper/xsecparser.cxx
+index 5c92e5efa104..9cc9312b4d9f 100644
+--- a/xmlsecurity/source/helper/xsecparser.cxx
+++ b/xmlsecurity/source/helper/xsecparser.cxx
+@@ -978,6 +978,9 @@ class XSecParser::XadesSigningCertificateContext
+ class XSecParser::XadesSigningTimeContext
+     : public XSecParser::Context
+ {
+    private:
+        OUString m_Value;
+
+     public:
+         XadesSigningTimeContext(XSecParser & rParser,
+                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+@@ -985,20 +988,14 @@ class XSecParser::XadesSigningTimeContext
+         {
+         }
+ 
+-        virtual void StartElement(
+-            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
+-        {
+-            m_rParser.m_ouDate.clear();
+-        }
+-
+         virtual void EndElement() override
+         {
+-            m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
+            m_rParser.m_pXSecController->setDate("", m_Value);
+         }
+ 
+         virtual void Characters(OUString const& rChars) override
+         {
+-            m_rParser.m_ouDate += rChars;
+            m_Value += rChars;
+         }
+ };
+ 
+@@ -1104,35 +1101,20 @@ class XSecParser::DcDateContext
+     : public XSecParser::Context
+ {
+     private:
+-        bool m_isIgnore = false;
+        OUString & m_rValue;
+ 
+     public:
+         DcDateContext(XSecParser & rParser,
+-                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
+                OUString & rValue)
+             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
+            , m_rValue(rValue)
+         {
+         }
+ 
+-        virtual void StartElement(
+-            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
+-        {
+-            m_isIgnore = !m_rParser.m_ouDate.isEmpty();
+-        }
+-
+-        virtual void EndElement() override
+-        {
+-            if (!m_isIgnore)
+-            {
+-                m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
+-            }
+-        }
+-
+         virtual void Characters(OUString const& rChars) override
+         {
+-            if (!m_isIgnore)
+-            {
+-                m_rParser.m_ouDate += rChars;
+-            }
+            m_rValue += rChars;
+         }
+ };
+ 
+@@ -1140,29 +1122,32 @@ class XSecParser::DcDescriptionContext
+     : public XSecParser::Context
+ {
+     private:
+-        OUString m_Value;
+        OUString & m_rValue;
+ 
+     public:
+         DcDescriptionContext(XSecParser & rParser,
+-                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
+                OUString & rValue)
+             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
+            , m_rValue(rValue)
+         {
+         }
+ 
+-        virtual void EndElement() override
+-        {
+-            m_rParser.m_pXSecController->setDescription(m_Value);
+-        }
+-
+         virtual void Characters(OUString const& rChars) override
+         {
+-            m_Value += rChars;
+            m_rValue += rChars;
+         }
+ };
+ 
+ class XSecParser::DsSignaturePropertyContext
+     : public XSecParser::Context
+ {
+    private:
+        enum class SignatureProperty { Unknown, Date, Description };
+        SignatureProperty m_Property = SignatureProperty::Unknown;
+        OUString m_Id;
+        OUString m_Value;
+
+     public:
+         DsSignaturePropertyContext(XSecParser & rParser,
+                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+@@ -1173,10 +1158,22 @@ class XSecParser::DsSignaturePropertyContext
+         virtual void StartElement(
+             css::uno::Reference<css::xml::sax::XAttributeList> const& xAttrs) override
+         {
+-            OUString const ouIdAttr(m_rParser.HandleIdAttr(xAttrs));
+-            if (!ouIdAttr.isEmpty())
+            m_Id = m_rParser.HandleIdAttr(xAttrs);
+        }
+
+        virtual void EndElement() override
+        {
+            switch (m_Property)
+             {
+-                m_rParser.m_pXSecController->setPropertyId( ouIdAttr );
+                case SignatureProperty::Unknown:
+                    SAL_INFO("xmlsecurity.helper", "Unknown property in ds:Object ignored");
+                    break;
+                case SignatureProperty::Date:
+                    m_rParser.m_pXSecController->setDate(m_Id, m_Value);
+                    break;
+                case SignatureProperty::Description:
+                    m_rParser.m_pXSecController->setDescription(m_Id, m_Value);
+                    break;
+             }
+         }
+ 
+@@ -1186,11 +1183,13 @@ class XSecParser::DsSignaturePropertyContext
+         {
+             if (nNamespace == XML_NAMESPACE_DC && rName == "date")
+             {
+-                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap));
+                m_Property = SignatureProperty::Date;
+                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
+             }
+             if (nNamespace == XML_NAMESPACE_DC && rName == "description")
+             {
+-                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap));
+                m_Property = SignatureProperty::Description;
+                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
+             }
+             return XSecParser::Context::CreateChildContext(std::move(pOldNamespaceMap), nNamespace, rName);
+         }
+diff --git a/xmlsecurity/source/helper/xsecparser.hxx b/xmlsecurity/source/helper/xsecparser.hxx
+index 93efcb766e3e..7a0eb08bca28 100644
+--- a/xmlsecurity/source/helper/xsecparser.hxx
+++ b/xmlsecurity/source/helper/xsecparser.hxx
+@@ -97,12 +97,6 @@ private:
+     class DsSignatureContext;
+     class DsigSignaturesContext;
+ 
+-    /*
+-     * the following members are used to reserve the signature information,
+-     * including X509IssuerName, X509SerialNumber, and X509Certificate,etc.
+-     */
+-    OUString m_ouDate;
+-
+     std::stack<std::unique_ptr<Context>> m_ContextStack;
+     std::unique_ptr<SvXMLNamespaceMap> m_pNamespaceMap;
+ 
+diff --git a/xmlsecurity/source/helper/xsecsign.cxx b/xmlsecurity/source/helper/xsecsign.cxx
+index 4d1b89949feb..5ed23281f083 100644
+--- a/xmlsecurity/source/helper/xsecsign.cxx
+++ b/xmlsecurity/source/helper/xsecsign.cxx
+@@ -132,8 +132,8 @@ cssu::Reference< cssxc::sax::XReferenceResolvedListener > XSecController::prepar
+     if (nStorageFormat != embed::StorageFormats::OFOPXML)
+     {
+         internalSignatureInfor.signatureInfor.ouSignatureId = createId();
+-        internalSignatureInfor.signatureInfor.ouPropertyId = createId();
+-        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouPropertyId, -1, OUString() );
+        internalSignatureInfor.signatureInfor.ouDateTimePropertyId = createId();
+        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouDateTimePropertyId, -1, OUString() );
+         size++;
+ 
+         if (bXAdESCompliantIfODF)
+diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx
+index 1f7fa9ac8ca8..5f5840334254 100644
+--- a/xmlsecurity/source/helper/xsecverify.cxx
+++ b/xmlsecurity/source/helper/xsecverify.cxx
+@@ -321,7 +321,7 @@ void XSecController::setGpgOwner( OUString const & ouGpgOwner )
+     isi.signatureInfor.ouGpgOwner = ouGpgOwner;
+ }
+ 
+-void XSecController::setDate( OUString const & ouDate )
+void XSecController::setDate(OUString const& rId, OUString const& ouDate)
+ {
+     if (m_vInternalSignatureInformations.empty())
+     {
+@@ -329,17 +329,31 @@ void XSecController::setDate( OUString const & ouDate )
+         return;
+     }
+     InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
+    // there may be multiple timestamps in a signature - check them for consistency
+    if (!isi.signatureInfor.ouDateTime.isEmpty()
+        && isi.signatureInfor.ouDateTime != ouDate)
+    {
+        isi.signatureInfor.hasInconsistentSigningTime = true;
+    }
+     (void)utl::ISO8601parseDateTime( ouDate, isi.signatureInfor.stDateTime);
+     isi.signatureInfor.ouDateTime = ouDate;
+    if (!rId.isEmpty())
+    {
+        isi.signatureInfor.ouDateTimePropertyId = rId;
+    }
+ }
+ 
+-void XSecController::setDescription(const OUString& rDescription)
+void XSecController::setDescription(OUString const& rId, OUString const& rDescription)
+ {
+     if (m_vInternalSignatureInformations.empty())
+         return;
+ 
+     InternalSignatureInformation& rInformation = m_vInternalSignatureInformations.back();
+     rInformation.signatureInfor.ouDescription = rDescription;
+    if (!rId.isEmpty())
+    {
+        rInformation.signatureInfor.ouDescriptionPropertyId = rId;
+    }
+ }
+ 
+ void XSecController::setSignatureBytes(const uno::Sequence<sal_Int8>& rBytes)
+@@ -433,27 +447,6 @@ void XSecController::setId( OUString const & ouId )
+     isi.signatureInfor.ouSignatureId = ouId;
+ }
+ 
+-void XSecController::setPropertyId( OUString const & ouPropertyId )
+-{
+-    if (m_vInternalSignatureInformations.empty())
+-    {
+-        SAL_INFO("xmlsecurity.helper","XSecController::setPropertyId: no signature");
+-        return;
+-    }
+-    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
+-
+-    if (isi.signatureInfor.ouPropertyId.isEmpty())
+-    {
+-        // <SignatureProperty> ID attribute is for the date.
+-        isi.signatureInfor.ouPropertyId = ouPropertyId;
+-    }
+-    else
+-    {
+-        // <SignatureProperty> ID attribute is for the description.
+-        isi.signatureInfor.ouDescriptionPropertyId = ouPropertyId;
+-    }
+-}
+-
+ /* public: for signature verify */
+ void XSecController::collectToVerify( const OUString& referenceId )
+ {
+-- 
+2.32.0
+
--- a/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
+++ b/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
@ -0,0 +1,117 @@
+From 4cfd591942e4cfd3efc416bfac8e46e3580d37ba Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 23 Mar 2022 13:03:30 +0000
+Subject: [PATCH] add infobar to prompt to refresh to replace old format
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131976
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit bbd196ff82bda9f66b4ba32a412f10cefe6da60e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132307
+Reviewed-by: Sophie Gautier <sophi@libreoffice.org>
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+(cherry picked from commit c5d01b11db3c83cb4a89d3b388d78e20dd3990b5)
+
+Change-Id: Id99cbf2b50a4ebf289dae6fc67e22e20afcda35b
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133906
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ include/sfx2/strings.hrc     |  2 ++
+ include/sfx2/viewfrm.hxx     |  1 +
+ sfx2/source/view/viewfrm.cxx | 40 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 43 insertions(+)
+
+diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
+index 1f21f0a0f186..1db36e733c0c 100644
+--- a/include/sfx2/strings.hrc
+++ b/include/sfx2/strings.hrc
+@@ -297,6 +297,8 @@
+ #define STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK   NC_("STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK", "The certificate could not be validated and the document is only partially signed.")
+ #define STR_SIGNATURE_OK                        NC_("STR_SIGNATURE_OK", "This document is digitally signed and the signature is valid.")
+ #define STR_SIGNATURE_SHOW                      NC_("STR_SIGNATURE_SHOW", "Show Signatures")
+#define STR_REFRESH_MASTER_PASSWORD             NC_("STR_REFRESH_MASTER_PASSWORD", "The master password is stored in an outdated format, you should refresh it")
+#define STR_REFRESH_PASSWORD                    NC_("STR_REFRESH_PASSWORD", "Refresh Password")
+ 
+ #define STR_CLOSE_PANE                          NC_("STR_CLOSE_PANE", "Close Pane")
+ #define STR_SFX_DOCK                            NC_("STR_SFX_DOCK", "Dock")
+diff --git a/include/sfx2/viewfrm.hxx b/include/sfx2/viewfrm.hxx
+index fe336ba5f091..cc6a7dae7047 100644
+--- a/include/sfx2/viewfrm.hxx
+++ b/include/sfx2/viewfrm.hxx
+@@ -61,6 +61,7 @@ protected:
+     DECL_LINK(WhatsNewHandler, Button*, void);
+     DECL_LINK(SwitchReadOnlyHandler, Button*, void);
+     DECL_LINK(SignDocumentHandler, Button*, void);
+    DECL_DLLPRIVATE_LINK(RefreshMasterPasswordHdl, Button*, void);
+     SAL_DLLPRIVATE void KillDispatcher_Impl();
+ 
+     virtual                 ~SfxViewFrame() override;
+diff --git a/sfx2/source/view/viewfrm.cxx b/sfx2/source/view/viewfrm.cxx
+index 5a64599e5894..86e7d51bbfea 100644
+--- a/sfx2/source/view/viewfrm.cxx
+++ b/sfx2/source/view/viewfrm.cxx
+@@ -32,6 +32,7 @@
+ #include <com/sun/star/frame/XLoadable.hpp>
+ #include <com/sun/star/frame/XLayoutManager.hpp>
+ #include <com/sun/star/frame/XComponentLoader.hpp>
+#include <com/sun/star/task/PasswordContainer.hpp>
+ #include <officecfg/Office/Common.hxx>
+ #include <officecfg/Setup.hxx>
+ #include <toolkit/helper/vclunohelper.hxx>
+@@ -1390,6 +1391,24 @@ void SfxViewFrame::Notify( SfxBroadcaster& /*rBC*/, const SfxHint& rHint )
+                     batch->commit();
+                 }
+ 
+                if (officecfg::Office::Common::Passwords::HasMaster::get() &&
+                    officecfg::Office::Common::Passwords::StorageVersion::get() == 0)
+                {
+                    // master password stored in deprecated format
+                    VclPtr<SfxInfoBarWindow> pOldMasterPasswordInfoBar =
+                        AppendInfoBar("oldmasterpassword", "",
+                                      SfxResId(STR_REFRESH_MASTER_PASSWORD), InfobarType::DANGER, false);
+                    if (pOldMasterPasswordInfoBar)
+                    {
+                        VclPtrInstance<PushButton> const xBtn(&GetWindow());
+                        xBtn->SetText(SfxResId(STR_REFRESH_PASSWORD));
+                        xBtn->SetSizePixel(xBtn->GetOptimalSize());
+                        xBtn->SetClickHdl(LINK(this,
+                           SfxViewFrame, RefreshMasterPasswordHdl));
+                        pOldMasterPasswordInfoBar->addButton(xBtn);
+                    }
+                }
+
+                 // read-only infobar if necessary
+                 const SfxViewShell *pVSh;
+                 const SfxShell *pFSh;
+@@ -1565,6 +1584,27 @@ IMPL_LINK_NOARG(SfxViewFrame, SignDocumentHandler, Button*, void)
+     GetDispatcher()->Execute(SID_SIGNATURE);
+ }
+ 
+IMPL_LINK_NOARG(SfxViewFrame, RefreshMasterPasswordHdl, Button*, void)
+{
+    bool bChanged = false;
+    try
+    {
+        Reference< task::XPasswordContainer2 > xMasterPasswd(
+            task::PasswordContainer::create(comphelper::getProcessComponentContext()));
+
+        css::uno::Reference<css::frame::XFrame> xFrame = GetFrame().GetFrameInterface();
+        css::uno::Reference<css::awt::XWindow> xContainerWindow = xFrame->getContainerWindow();
+
+        uno::Reference<task::XInteractionHandler> xTmpHandler(task::InteractionHandler::createWithParent(comphelper::getProcessComponentContext(),
+                                                              xContainerWindow));
+        bChanged = xMasterPasswd->changeMasterPassword(xTmpHandler);
+    }
+    catch (const Exception&)
+    {}
+    if (bChanged)
+        RemoveInfoBar(u"oldmasterpassword");
+}
+
+ void SfxViewFrame::Construct_Impl( SfxObjectShell *pObjSh )
+ {
+     m_pImpl->bResizeInToOut = true;
+-- 
+2.37.1
+
--- a/SOURCES/0004-Fix-use-of-uninitialized-SwFEShell-bTableCopied.patch
+++ b/SOURCES/0004-Fix-use-of-uninitialized-SwFEShell-bTableCopied.patch
@ -0,0 +1,74 @@
+From cba3b6a12c9f0dc67a93bc3b708497a8f5eea5a5 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Sun, 15 Dec 2019 10:03:56 +0100
+Subject: [PATCH 4/8] Fix use of uninitialized SwFEShell::bTableCopied
+
+...which had been introduced with 1e278d1d0cfb1d5375195aa764739f00633f21e8
+"tdf#37156 Writer menu: Paste as Nested table", during
+`make CppunitTest_sw_uiwriter CPPUNIT_TEST_NAME=SwUiWriterTest::testDde
+VALGRIND=memcheck`:
+
+> Conditional jump or move depends on uninitialised value(s)
+>    at 0x1EBBFAF8: SwTransferable::PrepareForCopy(bool) (sw/source/uibase/dochdl/swdtflvr.cxx:896)
+>    by 0x1EBC22BA: SwTransferable::Copy(bool) (sw/source/uibase/dochdl/swdtflvr.cxx:1144)
+>    by 0x1ECB552D: SwBaseShell::ExecClpbrd(SfxRequest&) (sw/source/uibase/shells/basesh.cxx:277)
+>    by 0x1C0D0BB0: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (include/sfx2/shell.hxx:197)
+>    by 0x1C0D72EB: SfxDispatcher::Execute_(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (sfx2/source/control/dispatch.cxx:764)
+>    by 0x1C153977: SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (sfx2/source/control/unoctitm.cxx:760)
+>    by 0x1C154916: SfxOfficeDispatch::dispatchWithNotification(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (sfx2/source/control/unoctitm.cxx:245)
+>    by 0x21FDE395: framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatch> const&, com::sun::star::util::URL const&, bool, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/dispatchhelper.cxx:151)
+>    by 0x21FDEC95: framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatchProvider> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/dispatchhelper.cxx:109)
+>    by 0x19BF89C7: lcl_dispatchCommand(com::sun::star::uno::Reference<com::sun::star::lang::XComponent> const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (sw/qa/extras/uiwriter/uiwriter.cxx:4048)
+>    by 0x19C1F3EC: SwUiWriterTest::testDde() (sw/qa/extras/uiwriter/uiwriter.cxx:4060)
+>  Uninitialised value was created by a heap allocation
+>    at 0x4839E86: operator new(unsigned long) (/builddir/build/BUILD/valgrind-3.15.0/coregrind/m_replacemalloc/vg_replace_malloc.c:344)
+>    by 0x1ED6DA43: SwView::SwView(SfxViewFrame*, SfxViewShell*) (sw/source/uibase/uiview/view.cxx:864)
+>    by 0x1ED70065: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) (sw/source/uibase/uiview/view0.cxx:79)
+>    by 0x1C347941: SfxBaseModel::createViewController(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfx2/source/doc/sfxbasemodel.cxx:4233)
+>    by 0x1C458D81: (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfx2/source/view/frmload.cxx:587)
+>    by 0x2401FAD0: framework::LoadEnv::impl_loadContent() (framework/source/loadenv/loadenv.cxx:1159)
+>    by 0x24020735: framework::LoadEnv::start() (framework/source/loadenv/loadenv.cxx:392)
+>    by 0x24020F89: framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, rtl::OUString const&, int, LoadEnvFeatures) (framework/source/loadenv/loadenv.cxx:297)
+>    by 0x2402175B: framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference<com::sun::star::frame::XComponentLoader> const&, com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/loadenv/loadenv.cxx:166)
+>    by 0x24058172: framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/desktop.cxx:610)
+>    by 0x1F5F7306: unotest::MacrosTest::loadFromDesktop(rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (unotest/source/cpp/macros_test.cxx:48)
+>    by 0x19C646A7: SwModelTestBase::loadURL(rtl::OUString const&, char const*, char const*) (sw/qa/inc/swmodeltestbase.hxx:764)
+>    by 0x19BD3792: SwUiWriterTest::createDoc(char const*) (sw/qa/extras/uiwriter/uiwriter.cxx:576)
+>    by 0x19C1F352: SwUiWriterTest::testDde() (sw/qa/extras/uiwriter/uiwriter.cxx:4055)
+
+(produced with a --enable-optimized build, so some inline frames are elided; see
+also <https://ci.libreoffice.org//job/lo_ubsan/1480/> for the same issue
+detected with UBSan).
+
+Change-Id: I080d296006bad4726942fb95a1338ea46c12bed4
+Reviewed-on: https://gerrit.libreoffice.org/85162
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit bcc74f619bf87ab97ffc48ab33e031d357952a70)
+---
+ sw/source/core/frmedt/fews.cxx | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sw/source/core/frmedt/fews.cxx b/sw/source/core/frmedt/fews.cxx
+index 2ad7ec20a86f..0c4e097287c2 100644
+--- a/sw/source/core/frmedt/fews.cxx
+++ b/sw/source/core/frmedt/fews.cxx
+@@ -665,6 +665,7 @@ SwFEShell::SwFEShell( SwDoc& rDoc, vcl::Window *pWindow, const SwViewOption *pOp
+     , m_bCheckForOLEInCaption(false)
+     , m_aPasteListeners(GetPasteMutex())
+     , m_eTableInsertMode(SwTable::SEARCH_NONE)
+    , bTableCopied(false)
+ {
+ }
+ 
+@@ -673,6 +674,7 @@ SwFEShell::SwFEShell( SwEditShell& rShell, vcl::Window *pWindow )
+     , m_bCheckForOLEInCaption(false)
+     , m_aPasteListeners(GetPasteMutex())
+     , m_eTableInsertMode(SwTable::SEARCH_NONE)
+    , bTableCopied(false)
+ {
+ }
+ 
+-- 
+2.28.0
+
--- a/SOURCES/0005-CVE-2021-25633.patch
+++ b/SOURCES/0005-CVE-2021-25633.patch
--- a/SOURCES/0005-cid-1460969-Uninitialized-scalar-field.patch
+++ b/SOURCES/0005-cid-1460969-Uninitialized-scalar-field.patch
@ -0,0 +1,35 @@
+From 2ebea3e9f3504ef97ecf8af198cd803a56240fe4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 27 Mar 2020 09:03:20 +0000
+Subject: [PATCH 5/8] cid#1460969 Uninitialized scalar field
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+multiple ctor's strikes again
+
+Change-Id: Ieaae6d5c9e76a3ade17289ce7d1bdffad1168cc9
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/91191
+Tested-by: Jenkins
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 698ecd52e4ca14b5ce633a3358a95992b0dd638c)
+---
+ dbaccess/source/core/dataaccess/ModelImpl.cxx | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx b/dbaccess/source/core/dataaccess/ModelImpl.cxx
+index d5c3b9b3e086..1f11f3679289 100644
+--- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
+++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
+@@ -407,6 +407,7 @@ ODatabaseModelImpl::ODatabaseModelImpl(
+             ,m_aEmbeddedMacros()
+             ,m_bModificationLock( false )
+             ,m_bDocumentInitialized( false )
+            ,m_nScriptingSignatureState(SignatureState::UNKNOWN)
+             ,m_aContext( _rxContext )
+             ,m_sName(_rRegistrationName)
+             ,m_nLoginTimeout(0)
+-- 
+2.28.0
+
--- a/SOURCES/0006-tdf-137897-scRetypePassInputDlg-re-allow-password-re.patch
+++ b/SOURCES/0006-tdf-137897-scRetypePassInputDlg-re-allow-password-re.patch
@ -0,0 +1,45 @@
+From 81618bd69088436eb60fd07b944effb178d788ae Mon Sep 17 00:00:00 2001
+From: Justin Luth <justin.luth@collabora.com>
+Date: Sat, 31 Oct 2020 15:36:44 +0300
+Subject: [PATCH 6/8] tdf#137897 scRetypePassInputDlg: re-allow password
+ removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This weld-conversion logic error caused a LO 6.1 regression
+in commit 0e4f93e88bfae3489d2de84fc2febed100880628.
+
+-   m_pPasswordGrid->Disable();
+   m_xPasswordGrid->set_sensitive(false);  //disable == false
+-   m_pBtnOk->Enable();
+   m_xBtnOk->set_sensitive(false);         //enable == true
+
+The result is that attempting to remove the password did not
+enable the OK button, so it was impossible.
+
+Change-Id: I4067b2ec6b89e86b21968d33c8850cca6d067e71
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105049
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 9eeaff5fa9070bea685db8b6bbd2dfc1565756ac)
+---
+ sc/source/ui/miscdlgs/retypepassdlg.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sc/source/ui/miscdlgs/retypepassdlg.cxx b/sc/source/ui/miscdlgs/retypepassdlg.cxx
+index 84f8ef182b54..fa31ea77e392 100644
+--- a/sc/source/ui/miscdlgs/retypepassdlg.cxx
+++ b/sc/source/ui/miscdlgs/retypepassdlg.cxx
+@@ -372,7 +372,7 @@ IMPL_LINK_NOARG(ScRetypePassInputDlg, RadioBtnHdl, weld::ToggleButton&, void)
+     else
+     {
+         m_xPasswordGrid->set_sensitive(false);
+-        m_xBtnOk->set_sensitive(false);
+        m_xBtnOk->set_sensitive(true);
+     }
+ }
+ 
+-- 
+2.28.0
+
--- a/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
+++ b/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
--- a/SOURCES/0007-tdf-137982-m_xFrame-is-already-disposed.patch
+++ b/SOURCES/0007-tdf-137982-m_xFrame-is-already-disposed.patch
@ -0,0 +1,137 @@
+From 7efe51c401ee469ae4835994e5f11b158fd354b9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 4 Nov 2020 13:01:53 +0000
+Subject: [PATCH 7/8] tdf#137982 m_xFrame is already disposed
+
+move the frame cleanup into a helper that listens to see if it got
+disposed by the preview itself
+
+Change-Id: I523285268118300f18b0f0f0a10fab7a9cced9c6
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105221
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@cib.de>
+(cherry picked from commit a986db4b2d24669e502e447036851e118cc23036)
+---
+ sw/source/ui/dbui/dbtablepreviewdialog.cxx | 53 ++++++++++++++++++----
+ sw/source/ui/dbui/dbtablepreviewdialog.hxx |  4 +-
+ 2 files changed, 46 insertions(+), 11 deletions(-)
+
+diff --git a/sw/source/ui/dbui/dbtablepreviewdialog.cxx b/sw/source/ui/dbui/dbtablepreviewdialog.cxx
+index 23e7984623d8..8f2d92b1c7d5 100644
+--- a/sw/source/ui/dbui/dbtablepreviewdialog.cxx
+++ b/sw/source/ui/dbui/dbtablepreviewdialog.cxx
+@@ -20,6 +20,8 @@
+ #include <swtypes.hxx>
+ #include "dbtablepreviewdialog.hxx"
+ #include <comphelper/processfactory.hxx>
+#include <cppuhelper/implbase.hxx>
+#include <com/sun/star/document/XEventListener.hpp>
+ #include <com/sun/star/frame/Frame.hpp>
+ #include <toolkit/helper/vclunohelper.hxx>
+ 
+@@ -32,6 +34,34 @@ using namespace ::com::sun::star::beans;
+ using namespace ::com::sun::star::lang;
+ using namespace ::com::sun::star::util;
+ 
+class DBTablePreviewFrame
+    : public cppu::WeakImplHelper<lang::XEventListener>
+{
+private:
+    css::uno::Reference<css::frame::XFrame2> m_xFrame;
+
+    virtual void SAL_CALL disposing(const lang::EventObject& /*Source*/) override
+    {
+        m_xFrame.clear();
+    }
+
+public:
+    DBTablePreviewFrame(css::uno::Reference<css::frame::XFrame2>& rFrame)
+        : m_xFrame(rFrame)
+    {
+    }
+
+    void cleanup()
+    {
+        if (m_xFrame.is())
+        {
+            m_xFrame->setComponent(nullptr, nullptr);
+            m_xFrame->dispose();
+            m_xFrame.clear();
+        }
+    }
+};
+
+ SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Sequence< beans::PropertyValue> const & rValues)
+     : SfxDialogController(pParent, "modules/swriter/ui/tablepreviewdialog.ui", "TablePreviewDialog")
+     , m_xDescriptionFI(m_xBuilder->weld_label("description"))
+@@ -51,22 +81,26 @@ SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Seque
+         m_xDescriptionFI->set_label(sDescription.replaceFirst("%1", sTemp));
+     }
+ 
+    css::uno::Reference<css::frame::XFrame2> xFrame;
+     try
+     {
+         // create a frame wrapper for myself
+-        m_xFrame = frame::Frame::create( comphelper::getProcessComponentContext() );
+-        m_xFrame->initialize(m_xBeamerWIN->CreateChildFrame());
+        xFrame = frame::Frame::create( comphelper::getProcessComponentContext() );
+        xFrame->initialize(m_xBeamerWIN->CreateChildFrame());
+     }
+     catch (uno::Exception const &)
+     {
+-        m_xFrame.clear();
+        xFrame.clear();
+     }
+-    if (m_xFrame.is())
+    if (xFrame.is())
+     {
+        m_xFrameListener.set(new DBTablePreviewFrame(xFrame));
+        xFrame->addEventListener(m_xFrameListener.get());
+
+         util::URL aURL;
+         aURL.Complete = ".component:DB/DataSourceBrowser";
+-        uno::Reference<frame::XDispatch> xD = m_xFrame->queryDispatch(aURL, "", 0x0C);
+-        if(xD.is())
+        uno::Reference<frame::XDispatch> xD = xFrame->queryDispatch(aURL, "", 0x0C);
+        if (xD.is())
+         {
+             xD->dispatch(aURL, rValues);
+             m_xBeamerWIN->show();
+@@ -76,11 +110,10 @@ SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Seque
+ 
+ SwDBTablePreviewDialog::~SwDBTablePreviewDialog()
+ {
+-    if(m_xFrame.is())
+    if (m_xFrameListener)
+     {
+-        m_xFrame->setComponent(nullptr, nullptr);
+-        m_xFrame->dispose();
+-        m_xFrame.clear();
+        m_xFrameListener->cleanup();
+        m_xFrameListener.clear();
+     }
+ }
+ 
+diff --git a/sw/source/ui/dbui/dbtablepreviewdialog.hxx b/sw/source/ui/dbui/dbtablepreviewdialog.hxx
+index ec2c58d92bf3..27e6e83d39ca 100644
+--- a/sw/source/ui/dbui/dbtablepreviewdialog.hxx
+++ b/sw/source/ui/dbui/dbtablepreviewdialog.hxx
+@@ -27,12 +27,14 @@ namespace com{ namespace sun{ namespace star{
+     namespace frame{ class XFrame2;     }
+     }}}
+ 
+class DBTablePreviewFrame;
+
+ class SwDBTablePreviewDialog : public SfxDialogController
+ {
+     std::unique_ptr<weld::Label> m_xDescriptionFI;
+     std::unique_ptr<weld::Container> m_xBeamerWIN;
+ 
+-    css::uno::Reference< css::frame::XFrame2 >         m_xFrame;
+    rtl::Reference<DBTablePreviewFrame> m_xFrameListener;
+ public:
+     SwDBTablePreviewDialog(weld::Window* pParent,
+             css::uno::Sequence< css::beans::PropertyValue> const & rValues  );
+-- 
+2.28.0
+
--- a/SOURCES/0008-Resolves-tdf-137215-restore-original-modality-before.patch
+++ b/SOURCES/0008-Resolves-tdf-137215-restore-original-modality-before.patch
@ -0,0 +1,52 @@
+From fa0371ce0456bfe355c36df0741ff23daeccb3a3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 3 Nov 2020 14:04:37 +0000
+Subject: [PATCH 8/8] Resolves: tdf#137215 restore original modality before
+ dialog loop ends
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105214
+Tested-by: Jenkins
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+(cherry picked from commit 022c11602d2101b49724b5cf104cc6c70b5a5e4b)
+
+Change-Id: I83467e28534b781c51b8d75a023e41f3c6a03903
+---
+ sc/source/ui/dbgui/validate.cxx | 8 ++++++++
+ sc/source/ui/inc/validate.hxx   | 2 ++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/sc/source/ui/dbgui/validate.cxx b/sc/source/ui/dbgui/validate.cxx
+index 41bc913db911..73e04cc44706 100644
+--- a/sc/source/ui/dbgui/validate.cxx
+++ b/sc/source/ui/dbgui/validate.cxx
+@@ -95,6 +95,14 @@ ScValidationDlg::ScValidationDlg(weld::Window* pParent, const SfxItemSet* pArgSe
+     AddTabPage("erroralert", ScTPValidationError::Create, nullptr);
+ }
+ 
+void ScValidationDlg::EndDialog()
+{
+    // tdf#137215 ensure original modalality of true is restored before dialog loop ends
+    if (m_bOwnRefHdlr)
+        RemoveRefDlg(true);
+    ScValidationDlgBase::EndDialog();
+}
+
+ ScValidationDlg::~ScValidationDlg()
+ {
+     if (m_bOwnRefHdlr)
+diff --git a/sc/source/ui/inc/validate.hxx b/sc/source/ui/inc/validate.hxx
+index 2c562717f921..cb88b9e8b40e 100644
+--- a/sc/source/ui/inc/validate.hxx
+++ b/sc/source/ui/inc/validate.hxx
+@@ -176,6 +176,8 @@ public:
+ 
+     void            SetModal(bool bModal) { m_xDialog->set_modal(bModal); }
+ 
+    virtual void EndDialog() override;
+
+     virtual void            SetReference( const ScRange& rRef, ScDocument* pDoc ) override
+     {
+         if ( m_pHandler && m_pSetReferenceHdl )
+-- 
+2.28.0
+
--- a/SOURCES/libreoffice-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uNwACgkQ9DSh76/u
+rqNXhQ/9GhwXWFcV4GyBa3TReuGs+1YrzpUvp+w/MA1wN5czpPwA9CAhivCti1pU
+dWwb2c/BePC+KBPthnjKNbuFIL00UuFuz4evEsNLykgwc3CCPXZDm5sxvJUAt1kf
+QzlL6XQxpk47v2fRs5wY5huO5rv45o33+N1GV1OCm9Y5vo67wWHnnQJCqIKsfEoY
+dWEvfFJxy9c7FiwbRZe9gZctGlOqRJpRbSwffchQ9fJQ5+10w5xhCdd5JrQheqe0
+G0JOHTbPYncv9C9+aTsye5maVEQj/Wi/SH6IzE5T5AGVEf1dguGOr//NLfuPoY0d
+Hrm17tKqsV1Lc7LzSwVAdes87bIjcNkITmfyKiaH3g4gDiL2Op9nsZiSwMad4+LX
+2GDQKfmqTyS1Um1SdqAMJezwlHOExT491arWwjfDeBmMDJfFNxzNRSihbqzFJs5/
+qfRjOSxpH0oRGMV4RSsLxDwjyzKAsUFQ2pZFx6A4qwp/X17+TulI3NnUHSNTMUaA
+rsRgopJb2NuTP3+lTPCotFUcbmFKuCHtAHw8mntyd54JnRHlooVW+/dJ1HyGqAbD
+moPg94GVKB0OPaw7D9hipG5dH1wsBz4vJXTEzJL8D/QOM7EmZDkzomPa/J10Pj4v
+DXUuzAmfU4bShr1wzZvhEBIVDoS8gPGYwArYdCD18bm9NPWrO3k=
+=ItCL
+-----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-help-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-help-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uPgACgkQ9DSh76/u
+rqNc+A/+PnNAFTvU3bHl8dwQGtRxBzcBuz0mkUTHET7qOPkzHsWwiaxmVhrDPvEd
+UvG5NiVzux/YnQpLfG9yFcHH78RHy3RKpYHsuUwlb8AWOpMIB4rX2IU2Kcn6jW1v
+2fokIVEvu5QzbI7sAyrxfAsdTGa+NALCG7oF8HmGVv/iVHZYTFYU7461LEqNSgbB
+uAO9SWV5FLDYxcg6bYHULLFylrD/YBdQrv2Jj16apwVpKNHJPj1qE00KIRl1fYQ6
+PasaGh1D6ZLKhAeOymr18eWQ0VZYmKjszddQExMbLTlxQZI+pZ8Bo6WKz7Y0IiwD
+aCcZeVOYRs40Xc4Mc7+6hxO1bGFrG1CvxPE3gdrTAsPmjRko3CNTRFfPyd/e0pHV
+0hpmIamL+OAE8V3gG5kSmVCtmnjhAtwnzBnqyuSU/J7thDOp0GUM+FBF6pxQPsf7
+IBZCHZALOO727A6+YR2JsBqmpDi+AxEPNaksDm+orkIG2hx5ai5LmfzgqF0gsBRN
+D//oVVpDM34JF5eLD4BOzUv3KqZYSmvDUqnkDF25bMJa5v637VoC7HiPypKRiCn1
+3SLV1YUxMP0EKu2QU7Bz36CLzkxJfEcyvje5//wravbxuDopZC4703fkK1WrANzL
+TviCWo1h03ClV1GEhDNB14hgzVN5kfVxaosve9U2Zyayabszj+s=
+=12X5
+-----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-multiliblauncher.sh
+++ b/SOURCES/libreoffice-multiliblauncher.sh
@ -0,0 +1,16 @@
+#!/bin/sh
+OOO_ARCH=$(uname -m)
+case $OOO_ARCH in
+	x86_64 | s390x | sparc64 | aarch64)
+		OOO_LIB_DIR="/usr/lib64"
+		SECONDARY_LIB_DIR="/usr/lib"
+		;;
+	* )
+		OOO_LIB_DIR="/usr/lib"
+		SECONDARY_LIB_DIR="/usr/lib64"
+		;;
+esac
+if [ ! -x $OOO_LIB_DIR/BRAND/program/LAUNCHER ]; then
+    OOO_LIB_DIR="$SECONDARY_LIB_DIR"
+fi
+exec $OOO_LIB_DIR/BRAND/program/LAUNCHER "$@"
--- a/SOURCES/libreoffice-translations-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-translations-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uPkACgkQ9DSh76/u
+rqOB9g/+OfPvMQSnfDsF4JE93HcL+z6PNa7yEIuflFSLWRxjtBRrep5FPT0mui5a
+PeCkLdR5TcHEQUa4GQuk5C6VLSbyQuEVoiO89Zj+xnLQGd96QJ5hyGjRqzPeP0kr
+KSq59cdT1PMETcZy4IQlqVKV7a71pBgCKXh1t3cr56rD8h97jh3lNqOU++6pmpYH
+F+IA4/GuWYA22M3oP+w0zmIR4HAdQB5RhxcAMQuLy+N7QUGRU27EMq8R8niRBp8G
+Hb8MqVSdy19Hz9GKc3sNHFg4GIEywf/6CY+ldaca63F0X/KWCYYY5Ql3K180LAjG
+wg6apwPynkCK05YjqlS8SedZlew9pH3sIauRM99aNC742EqsNoEY1dLEFWErdrr9
+tub2bc5nYX7Ku6RXhlL5orXdU0quZH3c7n26g7VWI6rKvSh4Bs1godWs1UK5hqTt
+jt/4RaMBvWzFTWbgQsWI3NLmTM/EOHAfhjDqTq5QPi+Wo3NaqBTlF1TiXJiLDWux
+rBb+FcnMmeWrFLCtvKk8T5jYzv0e/HtLH4o3rWaNwzuBAgeeZrroQpTneIVqv8+L
+HbE/GN1TaVIkc28RpX2PXdh918p1tmHNuKcPNQD+KIRP+FiBVfpFYm4/BtTb7nQU
+Nzh0AxSSSgNcaZaj7iegb/m55BGBhMRjm2iA3bCNNG8JapOfIrs=
+=Ot5W
+-----END PGP SIGNATURE-----
--- a/SPECS/libreoffice.spec
+++ b/SPECS/libreoffice.spec