← Back to branch summary

~ubuntu-branches/ubuntu/precise/kde-runtime/precise-updates

« back to all changes in this revision

Viewing changes to debian/patches/upstream_CVE-2014-8600.diff

  • Committer: Package Import Robot
  • Author(s): Jonathan Riddell
  • Date: 2014-11-20 15:46:42 UTC
  • mfrom: (18.1.5 precise-proposed)
  • Revision ID: package-import@ubuntu.com-20141120154642-hyesdbuvsk78ihtz
Tags: 4:4.8.5-0ubuntu0.3
https://launchpad.net/bugs/1393479
* SECURITY UPDATE: Insufficient Input Validation By IO Slaves and
  Webkit Part
 - Add upstream_CVE-2014-8600.diff to escape protocol twice: once
   for i18n, and once for HTML
 - https://www.kde.org/info/security/advisory-20141113-1.txt
 - CVE-2014-8600
 - LP: #1393479

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/upstream_CVE-2014-8600.diff
 
1
--- a/kioslave/bookmarks/kio_bookmarks.cpp
 
2
+++ b/kioslave/bookmarks/kio_bookmarks.cpp
 
3
@@ -22,6 +22,7 @@
 
4
 #include <stdlib.h>
 
5
 
 
6
 #include <qregexp.h>
 
7
+#include <qtextdocument.h>
 
8
 
 
9
 #include <kapplication.h>
 
10
 #include <kcmdlineargs.h>
 
11
@@ -197,7 +198,7 @@
 
12
     echoImage(regexp.cap(1), regexp.cap(2), url.queryItem("size"));
 
13
   } else {
 
14
     echoHead();
 
15
-    echo("<p class=\"message\">" + i18n("Wrong request: %1",path) + "</p>");
 
16
+    echo("<p class=\"message\">" + i18n("Bad request: %1", Qt::escape(Qt::escape(url.prettyUrl()))) + "</p>");
 
17
   }
 
18
   finished();
 
19
 }
 
20