Accepting request 461718 from KDE:Frameworks5

- Add patch to fix security issue with proxy configuration (boo#1027520)
  * sanitize-url-for-proxy.patch

- Update to 5.31.0
  * For more details please see:
    https://www.kde.org/announcements/kde-frameworks-5.31.0.php

OBS-URL: https://build.opensuse.org/request/show/461718
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/kio?expand=0&rev=43

kio-5.30.0.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:a15a688395e7c8a22e78b0cf5a8b9c3c4bd679bf667b23f50ae82b36cf5e363a
-size 3082084

kio-5.31.0.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:49173baf4c8687be45514220a4b32626d3a117939d2c42fe846010f1d23e3ee7
+size 3085324

kio.changes

@@ -1,3 +1,16 @@
+-------------------------------------------------------------------
+Wed Mar  1 21:02:49 UTC 2017 - fabian@ritter-vogt.de
+
+- Add patch to fix security issue with proxy configuration (boo#1027520)
+  * sanitize-url-for-proxy.patch
+
+-------------------------------------------------------------------
+Thu Feb  9 09:30:01 UTC 2017 - hrvoje.senjan@gmail.com
+
+- Update to 5.31.0
+  * For more details please see:
+    https://www.kde.org/announcements/kde-frameworks-5.31.0.php
+
 -------------------------------------------------------------------
 Sun Jan  8 23:41:46 UTC 2017 - hrvoje.senjan@gmail.com
 

kio.spec

@@ -17,9 +17,9 @@
 
 
 %bcond_without lang
-%define _tar_path 5.30
+%define _tar_path 5.31
 Name:           kio
-Version:        5.30.0
+Version:        5.31.0
 Release:        0
 %define kf5_version %{version}
 BuildRequires:  cmake >= 3.0
@@ -49,15 +49,15 @@ BuildRequires:  kxmlgui-devel >= %{_tar_path}
 BuildRequires:  libacl-devel
 BuildRequires:  libattr-devel
 BuildRequires:  solid-devel >= %{_tar_path}
-BuildRequires:  cmake(Qt5Concurrent) >= 5.5.0
+BuildRequires:  cmake(Qt5Concurrent) >= 5.6.0
-BuildRequires:  cmake(Qt5Core) >= 5.5.0
+BuildRequires:  cmake(Qt5Core) >= 5.6.0
-BuildRequires:  cmake(Qt5DBus) >= 5.5.0
+BuildRequires:  cmake(Qt5DBus) >= 5.6.0
-BuildRequires:  cmake(Qt5Network) >= 5.5.0
+BuildRequires:  cmake(Qt5Network) >= 5.6.0
-BuildRequires:  cmake(Qt5Script) >= 5.5.0
+BuildRequires:  cmake(Qt5Script) >= 5.6.0
-BuildRequires:  cmake(Qt5Test) >= 5.5.0
+BuildRequires:  cmake(Qt5Test) >= 5.6.0
-BuildRequires:  cmake(Qt5Widgets) >= 5.5.0
+BuildRequires:  cmake(Qt5Widgets) >= 5.6.0
-BuildRequires:  cmake(Qt5X11Extras) >= 5.5.0
+BuildRequires:  cmake(Qt5X11Extras) >= 5.6.0
-BuildRequires:  cmake(Qt5Xml) >= 5.5.0
+BuildRequires:  cmake(Qt5Xml) >= 5.6.0
 BuildRequires:  pkgconfig(openssl)
 BuildRequires:  pkgconfig(x11)
 Requires:       %{name}-core = %{version}
@@ -75,6 +75,8 @@ Source:         http://download.kde.org/stable/frameworks/%{_tar_path}/%{name}-%
 Source1:        baselibs.conf
 # PATCH-FIX-OPENSUSE kio_help-fallback-to-kde4-docs.patch -- allow kio_help to see into kde4 documentation, needed especially for khelpcenter5
 Patch0:         kio_help-fallback-to-kde4-docs.patch
+# PATCH-FIX-UPSTREAM sanitize-url-for-proxy.patch
+Patch1:         sanitize-url-for-proxy.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -84,8 +86,8 @@ file dialog also uses this to provide its network-enabled file management.
 
 %package core
 Summary:        Network transparent access to files and data
-Group:          System/GUI/KDE
 # core subpackage created with 5.9.0
+Group:          System/GUI/KDE
 Conflicts:      kio <= 5.8.0
 
 %description core
@@ -109,7 +111,7 @@ Requires:       kjobwidgets-devel >= %{_tar_path}
 Requires:       kservice-devel >= %{_tar_path}
 Requires:       kxmlgui-devel >= %{_tar_path}
 Requires:       solid-devel >= %{_tar_path}
-Requires:       cmake(Qt5Network) >= 5.5.0
+Requires:       cmake(Qt5Network) >= 5.6.0
 
 %description devel
 This framework implements almost all the file management functions you
@@ -121,6 +123,7 @@ Development files.
 %prep
 %setup -q
 %patch0 -p1
+%patch1 -p1
 
 %build
   %cmake_kf5 -d build

sanitize-url-for-proxy.patch

@@ -0,0 +1,40 @@
+From f9d0cb47cf94e209f6171ac0e8d774e68156a6e4 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Tue, 28 Feb 2017 19:00:48 +0100
+Subject: [PATCH] Sanitize URLs before passing them to FindProxyForURL
+
+Remove user/password information
+For https: remove path and query
+
+Thanks to safebreach.com for reporting the problem
+
+CCMAIL: yoni.fridburg@safebreach.com
+CCMAIL: amit.klein@safebreach.com
+CCMAIL: itzik.kotler@safebreach.com
+---
+ src/kpac/script.cpp | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/src/kpac/script.cpp b/src/kpac/script.cpp
+index a0235f7..2485c54 100644
+--- a/src/kpac/script.cpp
++++ b/src/kpac/script.cpp
+@@ -754,9 +754,16 @@ QString Script::evaluate(const QUrl &url)
+         }
+     }
+ 
++    QUrl cleanUrl = url;
++    cleanUrl.setUserInfo(QString());
++    if (cleanUrl.scheme() == QLatin1String("https")) {
++        cleanUrl.setPath(QString());
++        cleanUrl.setQuery(QString());
++    }
++
+     QScriptValueList args;
+-    args << url.url();
+-    args << url.host();
++    args << cleanUrl.url();
++    args << cleanUrl.host();
+ 
+     QScriptValue result = func.call(QScriptValue(), args);
+     if (result.isError()) {