41d68c2fd4
- Add upstream patches to fix security issues in kdeconnect (CVE-2020-26164, boo#1176268): * 0001-Do-not-leak-the-local-user-in-the-device-name.patch * 0002-Fix-use-after-free-in-LanLinkProvider-connectError.patch * 0003-Limit-identity-packets-to-8KiB.patch * 0004-Do-not-let-lanlink-connections-stay-open-for-long-wi.patch * 0005-Don-t-brute-force-reading-the-socket.patch * 0006-Limit-number-of-connected-sockets-from-unpaired-devi.patch * 0007-Do-not-remember-more-than-a-few-identity-packets-at-.patch * 0008-Limit-the-ports-we-try-to-connect-to-to-the-port-ran.patch * 0009-Do-not-replace-connections-for-a-given-deviceId-if-t.patch OBS-URL: https://build.opensuse.org/request/show/839167 OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/kdeconnect-kde?expand=0&rev=17
33 lines
1.1 KiB
Diff
33 lines
1.1 KiB
Diff
From b279c52101d3f7cc30a26086d58de0b5f1c547fa Mon Sep 17 00:00:00 2001
|
|
From: Albert Vaca Cintora <albertvaka@gmail.com>
|
|
Date: Thu, 24 Sep 2020 17:01:03 +0200
|
|
Subject: [PATCH 1/9] Do not leak the local user in the device name.
|
|
|
|
Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.
|
|
---
|
|
core/kdeconnectconfig.cpp | 8 +-------
|
|
1 file changed, 1 insertion(+), 7 deletions(-)
|
|
|
|
diff --git a/core/kdeconnectconfig.cpp b/core/kdeconnectconfig.cpp
|
|
index 91719303..a8dbcf5c 100644
|
|
--- a/core/kdeconnectconfig.cpp
|
|
+++ b/core/kdeconnectconfig.cpp
|
|
@@ -90,13 +90,7 @@ KdeConnectConfig::KdeConnectConfig()
|
|
|
|
QString KdeConnectConfig::name()
|
|
{
|
|
- QString username;
|
|
- #ifdef Q_OS_WIN
|
|
- username = QString::fromLatin1(qgetenv("USERNAME"));
|
|
- #else
|
|
- username = QString::fromLatin1(qgetenv("USER"));
|
|
- #endif
|
|
- QString defaultName = username + QStringLiteral("@") + QHostInfo::localHostName();
|
|
+ QString defaultName = QHostInfo::localHostName();
|
|
QString name = d->m_config->value(QStringLiteral("name"), defaultName).toString();
|
|
return name;
|
|
}
|
|
--
|
|
2.28.0
|
|
|