Accepting request 1175447 from home:AndreasStieger:branches:GNOME:Factory

xdg-desktop-portal 1.18.4
CVE-2024-32462, boo#1223110

OBS-URL: https://build.opensuse.org/request/show/1175447
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/xdg-desktop-portal?expand=0&rev=83

xdg-desktop-portal-1.18.2.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:dfac239c5476aafd117a9a10131a2f0b142f72106c52fc03859938e00545f440
-size 698912

xdg-desktop-portal.changes

@@ -1,3 +1,23 @@
+-------------------------------------------------------------------
+Sat May 18 15:53:53 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- update to 1.18.4:
+  + Don't allow commandline arrays when the first commandline item
+    starts with whitespace or hyphen. (CVE-2024-32462, boo#1223110)
+  + Do not store device access permission if it returned an error
+  + Fix crash with config files without a default backend set
+- includes changes from 1.18.3:
+  + Don't try to read D-Bus object properties of Request objects on
+    construction
+  + Fix various memory and file descriptor leaks.
+  + Minuscule optimization to the ScreenCast portal so that it
+    stores restoration data with a single D-Bus call, instead of two.
+  + Fix a crash in the OpenURI file when trying to open a non-
+    existing file
+  + Fix a bug in PipeWire that prevented cameras from being
+    reported reliably.
+  + Various smaller bug fixes.
+
 -------------------------------------------------------------------
 Fri Jan 12 12:48:49 UTC 2024 - Callum Farmer <gmbr3@opensuse.org>
 

xdg-desktop-portal.spec

@@ -2,6 +2,7 @@
 # spec file for package xdg-desktop-portal
 #
 # Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 Andreas Stieger <Andreas.Stieger@gmx.de>
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +18,7 @@
 
 
 Name:           xdg-desktop-portal
-Version:        1.18.2
+Version:        1.18.4
 Release:        0
 Summary:        A portal frontend service for Flatpak
 License:        LGPL-2.1-or-later
@@ -116,6 +117,7 @@ install -d %{buildroot}%{_datadir}/xdg-desktop-portal/portals
 %{_mandir}/man5/portals.conf.5%{?ext_man}
 
 %files devel
+%license COPYING
 %doc %{_datadir}/doc/%{name}/
 %if %{pkg_vcmp meson < 0.62.0 }
 %{_libdir}/pkgconfig/%{name}.pc
@@ -124,5 +126,6 @@ install -d %{buildroot}%{_datadir}/xdg-desktop-portal/portals
 %endif
 
 %files lang -f %{name}.lang
+%license COPYING
 
 %changelog