diff --git a/SOURCES/0001-CVE-2022-38745.patch b/SOURCES/0001-CVE-2022-38745.patch
new file mode 100644
index 0000000..01dde2d
--- /dev/null
+++ b/SOURCES/0001-CVE-2022-38745.patch
@@ -0,0 +1,93 @@
+From dbf825c25195e29a00228f31112c5aaa2102f692 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Mon, 21 Feb 2022 11:55:21 +0100
+Subject: [PATCH] Avoid unnecessary empty -Djava.class.path=
+
+Change-Id: Idcfe7321077b60381c0273910b1faeb444ef1fd8
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130242
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+---
+ .../plugins/sunmajor/pluginlib/sunjavaplugin.cxx | 16 +++++++++++++---
+ jvmfwk/source/framework.cxx                      |  8 ++++++--
+ jvmfwk/source/fwkbase.cxx                        |  3 +++
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+index f47b0a3..843f6d1 100644
+--- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
++++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+@@ -713,17 +713,22 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+     // all versions below 1.5.1
+     options.emplace_back("abort", reinterpret_cast<void*>(abort_handler));
+     bool hasStackSize = false;
++#ifdef UNX
++    // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
++    // in the class path in order to have applet support:
++    OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
++#endif
+     for (int i = 0; i < cOptions; i++)
+     {
+         OString opt(arOptions[i].optionString);
+ #ifdef UNX
+-        // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
+-        // in the class path in order to have applet support:
+         if (opt.startsWith("-Djava.class.path="))
+         {
+-            OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
+             if (!sAddPath.isEmpty())
++            {
+                 opt += OStringChar(SAL_PATHSEPARATOR) + sAddPath;
++                sAddPath.clear();
++            }
+         }
+ #endif
+         if (opt == "-Xint") {
+@@ -768,6 +773,11 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+         }
+ #endif
+     }
++#ifdef UNX
++    if (!sAddPath.isEmpty()) {
++        options.emplace_back("-Djava.class.path=" + sAddPath, nullptr);
++    }
++#endif
+ 
+     std::unique_ptr<JavaVMOption[]> sarOptions(new JavaVMOption[options.size()]);
+     for (std::vector<Option>::size_type i = 0; i != options.size(); ++i) {
+diff --git a/jvmfwk/source/framework.cxx b/jvmfwk/source/framework.cxx
+index 5a7cef4..478b42b 100644
+--- a/jvmfwk/source/framework.cxx
++++ b/jvmfwk/source/framework.cxx
+@@ -189,8 +189,12 @@ javaFrameworkError jfw_startVM(
+                 //In direct mode the options are specified by bootstrap variables
+                 //of the form UNO_JAVA_JFW_PARAMETER_1 .. UNO_JAVA_JFW_PARAMETER_n
+                 vmParams = jfw::BootParams::getVMParameters();
+-                sUserClassPath =
+-                    "-Djava.class.path=" + jfw::BootParams::getClasspath();
++                auto const cp = jfw::BootParams::getClasspath();
++                if (!cp.isEmpty())
++                {
++                    sUserClassPath =
++                        "-Djava.class.path=" + cp;
++                }
+             }
+             else
+                 OSL_ASSERT(false);
+diff --git a/jvmfwk/source/fwkbase.cxx b/jvmfwk/source/fwkbase.cxx
+index df84d7c..de1acdb 100644
+--- a/jvmfwk/source/fwkbase.cxx
++++ b/jvmfwk/source/fwkbase.cxx
+@@ -458,6 +458,9 @@ OString makeClassPathOption(OUString const & sUserClassPath)
+ 
+     sPaths = OUStringToOString(
+         sBufCP.makeStringAndClear(), osl_getThreadTextEncoding());
++    if (sPaths.isEmpty()) {
++        return "";
++    }
+ 
+     OString sOptionClassPath = "-Djava.class.path=" + sPaths;
+     return sOptionClassPath;
+-- 
+2.39.2
+
diff --git a/SOURCES/0001-Don-t-use-Library_tl-in-URE-libraries.patch b/SOURCES/0001-Don-t-use-Library_tl-in-URE-libraries.patch
new file mode 100644
index 0000000..5f2ec17
--- /dev/null
+++ b/SOURCES/0001-Don-t-use-Library_tl-in-URE-libraries.patch
@@ -0,0 +1,364 @@
+From fee5967ab6ce7226f9baed984d7b1c49173a0c59 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Thu, 24 Feb 2022 14:31:23 +0100
+Subject: [PATCH] Don't use Library_tl in URE libraries
+
+This partly reverts 8b5e23eac31cafbd442a3acab5fbcf98bfd0af11 "log nice exception
+messages whereever possible", e1eb7cb04a4c30cec238ab0f54d41a6cdc3299c1
+"loplugin:logexceptionnicely in starmath..svgio",
+d6d80c4e1783b4459bd4a8fbcbdfeebe416c1cb5 "OSL_FAIL.*exception ->
+TOOLS_WARN_EXCEPTION", and 877f40ac3f2add2b6dc37bae280d4d98dd102286 "tdf#42949
+Fix new IWYU warnings in directories [h-r]*", and adapts
+loplugin:logexceptionnicely accordingly.
+
+Change-Id: I792b853b988c7c5f77179ca0672c30cb4223b5a6
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130502
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+
+Cherry-picked from 9c431f4d3afed0aad21b5ba67a5a55328c4d0685
+Conflicts:
+	stoc/source/javavm/javavm.cxx
+---
+ compilerplugins/clang/logexceptionnicely.cxx  |  6 +++++
+ io/Library_io.mk                              |  1 -
+ io/source/stm/opump.cxx                       | 24 ++++++++++---------
+ javaunohelper/Library_juhx.mk                 |  1 -
+ javaunohelper/source/bootstrap.cxx            |  7 ++----
+ stoc/Library_bootstrap.mk                     |  1 -
+ stoc/Library_javaloader.mk                    |  1 -
+ stoc/Library_javavm.mk                        |  1 -
+ stoc/source/javaloader/javaloader.cxx         |  7 +++---
+ stoc/source/javavm/javavm.cxx                 | 17 +++++++------
+ stoc/source/servicemanager/servicemanager.cxx | 13 +++++-----
+ 11 files changed, 39 insertions(+), 40 deletions(-)
+
+diff --git a/compilerplugins/clang/logexceptionnicely.cxx b/compilerplugins/clang/logexceptionnicely.cxx
+index a262d276b88c..fb5b1f86ed59 100644
+--- a/compilerplugins/clang/logexceptionnicely.cxx
++++ b/compilerplugins/clang/logexceptionnicely.cxx
+@@ -46,6 +46,12 @@ public:
+             return false;
+         if (loplugin::hasPathnamePrefix(fn, SRCDIR "/comphelper/"))
+             return false;
++        if (loplugin::hasPathnamePrefix(fn, SRCDIR "/io/"))
++            return false;
++        if (loplugin::hasPathnamePrefix(fn, SRCDIR "/javaunohelper/"))
++            return false;
++        if (loplugin::hasPathnamePrefix(fn, SRCDIR "/stoc/"))
++            return false;
+         // can't do that here, don't have an Any
+         if (loplugin::hasPathnamePrefix(fn, SRCDIR
+                                         "/connectivity/source/drivers/hsqldb/HStorageMap.cxx"))
+diff --git a/io/Library_io.mk b/io/Library_io.mk
+index b961b437cd46..fc61f3366e1b 100644
+--- a/io/Library_io.mk
++++ b/io/Library_io.mk
+@@ -17,7 +17,6 @@ $(eval $(call gb_Library_use_libraries,io,\
+     cppu \
+     cppuhelper \
+     sal \
+-    tl \
+ ))
+ 
+ $(eval $(call gb_Library_set_componentfile,io,io/source/io))
+diff --git a/io/source/stm/opump.cxx b/io/source/stm/opump.cxx
+index 7ba8752d8dfb..d120dd37f8ed 100644
+--- a/io/source/stm/opump.cxx
++++ b/io/source/stm/opump.cxx
+@@ -18,6 +18,8 @@
+  */
+ 
+ 
++#include <sal/log.hxx>
++
+ #include <com/sun/star/io/IOException.hpp>
+ #include <com/sun/star/io/NotConnectedException.hpp>
+ #include <com/sun/star/io/XActiveDataSource.hpp>
+@@ -32,7 +34,7 @@
+ #include <cppuhelper/supportsservice.hxx>
+ #include <osl/mutex.hxx>
+ #include <osl/thread.h>
+-#include <tools/diagnose_ex.h>
++
+ 
+ using namespace osl;
+ using namespace std;
+@@ -124,9 +126,9 @@ void Pump::fireError( const  Any & exception )
+         {
+             static_cast< XStreamListener * > ( iter.next() )->error( exception );
+         }
+-        catch ( const RuntimeException & )
++        catch ( const RuntimeException &e )
+         {
+-            TOOLS_WARN_EXCEPTION("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners");
++            SAL_WARN("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners" << e);
+         }
+     }
+ }
+@@ -153,9 +155,9 @@ void Pump::fireClose()
+         {
+             static_cast< XStreamListener * > ( iter.next() )->closed( );
+         }
+-        catch ( const RuntimeException & )
++        catch ( const RuntimeException &e )
+         {
+-            TOOLS_WARN_EXCEPTION("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners");
++            SAL_WARN("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners" << e);
+         }
+     }
+ }
+@@ -169,9 +171,9 @@ void Pump::fireStarted()
+         {
+             static_cast< XStreamListener * > ( iter.next() )->started( );
+         }
+-        catch ( const RuntimeException & )
++        catch ( const RuntimeException &e )
+         {
+-            TOOLS_WARN_EXCEPTION("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners");
++            SAL_WARN("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners" << e);
+         }
+     }
+ }
+@@ -185,9 +187,9 @@ void Pump::fireTerminated()
+         {
+             static_cast< XStreamListener * > ( iter.next() )->terminated();
+         }
+-        catch ( const RuntimeException & )
++        catch ( const RuntimeException &e )
+         {
+-            TOOLS_WARN_EXCEPTION("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners");
++            SAL_WARN("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners" << e);
+         }
+     }
+ }
+@@ -285,11 +287,11 @@ void Pump::run()
+         close();
+         fireClose();
+     }
+-    catch ( const css::uno::Exception & )
++    catch ( const css::uno::Exception &e )
+     {
+         // we are the last on the stack.
+         // this is to avoid crashing the program, when e.g. a bridge crashes
+-        TOOLS_WARN_EXCEPTION("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners");
++        SAL_WARN("io.streams","com.sun.star.comp.stoc.Pump: unexpected exception during calling listeners" << e);
+     }
+ }
+ 
+diff --git a/javaunohelper/Library_juhx.mk b/javaunohelper/Library_juhx.mk
+index 6eacff250c0f..1a24e5ef54f2 100644
+--- a/javaunohelper/Library_juhx.mk
++++ b/javaunohelper/Library_juhx.mk
+@@ -19,7 +19,6 @@ $(eval $(call gb_Library_use_libraries,juhx,\
+     jvmaccess \
+     sal \
+     salhelper \
+-    tl \
+ ))
+ 
+ $(eval $(call gb_Library_add_exception_objects,juhx,\
+diff --git a/javaunohelper/source/bootstrap.cxx b/javaunohelper/source/bootstrap.cxx
+index e7bf63b841de..6ad39d467444 100644
+--- a/javaunohelper/source/bootstrap.cxx
++++ b/javaunohelper/source/bootstrap.cxx
+@@ -36,7 +36,6 @@
+ 
+ #include <jni.h>
+ #include <jvmaccess/unovirtualmachine.hxx>
+-#include <tools/diagnose_ex.h>
+ 
+ #include "juhx-export-functions.hxx"
+ #include "vm.hxx"
+@@ -148,11 +147,10 @@ jobject Java_com_sun_star_comp_helper_Bootstrap_cppuhelper_1bootstrap(
+     }
+     catch (const RuntimeException & exc)
+     {
+-        css::uno::Any exAny( cppu::getCaughtException() );
+         jclass c = jni_env->FindClass( "com/sun/star/uno/RuntimeException" );
+         if (nullptr != c)
+         {
+-            SAL_WARN("javaunohelper", "forwarding RuntimeException: " << exceptionToString(exAny) );
++            SAL_WARN("javaunohelper", "forwarding RuntimeException: " << exc );
+             OString cstr( OUStringToOString(
+                               exc.Message, RTL_TEXTENCODING_JAVA_UTF8 ) );
+             jni_env->ThrowNew( c, cstr.getStr() );
+@@ -160,11 +158,10 @@ jobject Java_com_sun_star_comp_helper_Bootstrap_cppuhelper_1bootstrap(
+     }
+     catch (const Exception & exc)
+     {
+-        css::uno::Any ex( cppu::getCaughtException() );
+         jclass c = jni_env->FindClass( "com/sun/star/uno/Exception" );
+         if (nullptr != c)
+         {
+-            SAL_WARN("javaunohelper",  "forwarding Exception: " << exceptionToString(ex) );
++            SAL_WARN("javaunohelper",  "forwarding Exception: " << exc );
+             OString cstr( OUStringToOString(
+                               exc.Message, RTL_TEXTENCODING_JAVA_UTF8 ) );
+             jni_env->ThrowNew( c, cstr.getStr() );
+diff --git a/stoc/Library_bootstrap.mk b/stoc/Library_bootstrap.mk
+index 49fbafc12a09..3cc57e868d29 100644
+--- a/stoc/Library_bootstrap.mk
++++ b/stoc/Library_bootstrap.mk
+@@ -32,7 +32,6 @@ $(eval $(call gb_Library_use_libraries,bootstrap,\
+     reg \
+     sal \
+     salhelper \
+-    tl \
+ ))
+ 
+ $(eval $(call gb_Library_set_componentfile,bootstrap,stoc/util/bootstrap))
+diff --git a/stoc/Library_javaloader.mk b/stoc/Library_javaloader.mk
+index caf4a1e27df6..f0b11fb4a9dc 100644
+--- a/stoc/Library_javaloader.mk
++++ b/stoc/Library_javaloader.mk
+@@ -19,7 +19,6 @@ $(eval $(call gb_Library_use_libraries,javaloader,\
+     jvmaccess \
+     sal \
+     salhelper \
+-    tl \
+ ))
+ 
+ $(eval $(call gb_Library_set_componentfile,javaloader,stoc/source/javaloader/javaloader))
+diff --git a/stoc/Library_javavm.mk b/stoc/Library_javavm.mk
+index ce5f773ef394..84e29e8556e0 100644
+--- a/stoc/Library_javavm.mk
++++ b/stoc/Library_javavm.mk
+@@ -21,7 +21,6 @@ $(eval $(call gb_Library_use_libraries,javavm,\
+     jvmfwk \
+     sal \
+     salhelper \
+-    tl \
+ ))
+ 
+ $(eval $(call gb_Library_set_componentfile,javavm,stoc/source/javavm/javavm))
+diff --git a/stoc/source/javaloader/javaloader.cxx b/stoc/source/javaloader/javaloader.cxx
+index 73b0ddf557ff..036ea71af93a 100644
+--- a/stoc/source/javaloader/javaloader.cxx
++++ b/stoc/source/javaloader/javaloader.cxx
+@@ -26,7 +26,6 @@
+ #include <com/sun/star/uno/RuntimeException.hpp>
+ #include <com/sun/star/lang/WrappedTargetRuntimeException.hpp>
+ #include <cppuhelper/exc_hlp.hxx>
+-#include <tools/diagnose_ex.h>
+ 
+ #ifdef LINUX
+ #undef minor
+@@ -328,8 +327,10 @@ stoc_JavaComponentLoader_get_implementation(
+     try {
+         return cppu::acquire(new JavaComponentLoader(context));
+     }
+-    catch(const RuntimeException &) {
+-        TOOLS_INFO_EXCEPTION("stoc", "could not init javaloader");
++    catch(const RuntimeException & runtimeException) {
++        SAL_INFO(
++            "stoc",
++            "could not init javaloader due to " << runtimeException);
+         throw;
+     }
+ }
+diff --git a/stoc/source/javavm/javavm.cxx b/stoc/source/javavm/javavm.cxx
+index 8600a23eb759..8d95f71a68a3 100644
+--- a/stoc/source/javavm/javavm.cxx
++++ b/stoc/source/javavm/javavm.cxx
+@@ -61,7 +61,6 @@
+ #include <rtl/ustring.hxx>
+ #include <sal/types.h>
+ #include <sal/log.hxx>
+-#include <tools/diagnose_ex.h>
+ #include <uno/current_context.hxx>
+ #include <jvmfwk/framework.hxx>
+ #include <i18nlangtag/languagetag.hxx>
+@@ -423,23 +422,23 @@ void initVMConfiguration(
+     try {
+         getINetPropsFromConfig(&jvm, xSMgr, xCtx);
+     }
+-    catch(const css::uno::Exception &) {
+-        TOOLS_INFO_EXCEPTION("stoc", "can not get INETProps");
++    catch(const css::uno::Exception & exception) {
++        SAL_INFO("stoc", "can not get INETProps because of " << exception);
+     }
+ 
+     try {
+         getDefaultLocaleFromConfig(&jvm, xSMgr,xCtx);
+     }
+-    catch(const css::uno::Exception &) {
+-        TOOLS_INFO_EXCEPTION("stoc", "can not get locale");
++    catch(const css::uno::Exception & exception) {
++        SAL_INFO("stoc", "can not get locale because of " << exception);
+     }
+ 
+     try
+     {
+         getJavaPropsFromSafetySettings(&jvm, xSMgr, xCtx);
+     }
+-    catch(const css::uno::Exception &) {
+-        TOOLS_INFO_EXCEPTION("stoc", "couldn't get safety settings");
++    catch(const css::uno::Exception & exception) {
++        SAL_INFO("stoc", "couldn't get safety settings because of " << exception);
+     }
+ 
+     *pjvm= jvm;
+@@ -1213,9 +1212,9 @@ void JavaVirtualMachine::registerConfigChangesListener()
+             if (m_xJavaConfiguration.is())
+                 m_xJavaConfiguration->addContainerListener(this);
+         }
+-    }catch(const css::uno::Exception &)
++    }catch(const css::uno::Exception & e)
+     {
+-        TOOLS_INFO_EXCEPTION("stoc", "could not set up listener for Configuration");
++        SAL_INFO("stoc", "could not set up listener for Configuration because of >" << e << "<");
+     }
+ }
+ 
+diff --git a/stoc/source/servicemanager/servicemanager.cxx b/stoc/source/servicemanager/servicemanager.cxx
+index ba728ba1fa88..1a53ecf97f63 100644
+--- a/stoc/source/servicemanager/servicemanager.cxx
++++ b/stoc/source/servicemanager/servicemanager.cxx
+@@ -24,7 +24,6 @@
+ #include <osl/diagnose.h>
+ #include <rtl/ustrbuf.hxx>
+ #include <sal/log.hxx>
+-#include <tools/diagnose_ex.h>
+ 
+ #include <cppuhelper/factory.hxx>
+ #include <cppuhelper/weakref.hxx>
+@@ -611,9 +610,9 @@ void OServiceManager::disposing()
+             if( xComp.is() )
+                 xComp->dispose();
+         }
+-        catch (const RuntimeException &)
++        catch (const RuntimeException & exc)
+         {
+-            TOOLS_INFO_EXCEPTION("stoc", "RuntimeException occurred upon disposing factory:");
++            SAL_INFO("stoc", "RuntimeException occurred upon disposing factory: " << exc);
+         }
+     }
+ 
+@@ -797,9 +796,9 @@ Reference< XInterface > OServiceManager::createInstanceWithContext(
+                 }
+             }
+         }
+-        catch (const lang::DisposedException &)
++        catch (const lang::DisposedException & exc)
+         {
+-            TOOLS_INFO_EXCEPTION("stoc", "");
++            SAL_INFO("stoc", "DisposedException occurred: " << exc);
+         }
+     }
+ 
+@@ -849,9 +848,9 @@ Reference< XInterface > OServiceManager::createInstanceWithArgumentsAndContext(
+                 }
+             }
+         }
+-        catch (const lang::DisposedException &)
++        catch (const lang::DisposedException & exc)
+         {
+-            TOOLS_INFO_EXCEPTION("stoc", "DisposedException occurred:");
++            SAL_INFO("stoc", "DisposedException occurred: " << exc);
+         }
+     }
+ 
+-- 
+2.40.1
+
diff --git a/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch b/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
new file mode 100644
index 0000000..362ae1c
--- /dev/null
+++ b/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
@@ -0,0 +1,77 @@
+From d6bfde52b0b51e96075cfb195c2f9d8200a0fb08 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Thu, 16 Feb 2023 20:20:31 +0100
+Subject: [PATCH 1/3] Obtain actual 0-parameter count for OR(), AND() and
+ 1-parameter functions
+
+OR and AND for legacy infix notation are classified as binary
+operators but in fact are functions with parameter count. In case
+no argument is supplied, GetByte() returns 0 and for that case the
+implicit binary operator 2 parameters were wrongly assumed.
+Similar for functions expecting 1 parameter, without argument 1
+was assumed. For "real" unary and binary operators the compiler
+already checks parameters. Omit OR and AND and 1-parameter
+functions from this implicit assumption and return the actual 0
+count.
+
+Change-Id: Ie05398c112a98021ac2875cf7b6de994aee9d882
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147173
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit e7ce9bddadb2db222eaa5f594ef1de2e36d57e5c)
+---
+ formula/source/core/api/token.cxx | 13 +++++--------
+ sc/source/core/tool/interpr4.cxx  | 10 +++++++++-
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
+index 37dd26979ced..c2b12cf3a145 100644
+--- a/formula/source/core/api/token.cxx
++++ b/formula/source/core/api/token.cxx
+@@ -93,17 +93,14 @@ sal_uInt8 FormulaToken::GetParamCount() const
+         return 0;       // parameters and specials
+                         // ocIf... jump commands not for FAP, have cByte then
+ //2do: bool parameter whether FAP or not?
+-    else if ( GetByte() )
++    else if (GetByte())
+         return GetByte();   // all functions, also ocExternal and ocMacro
+-    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP)
+-        return 2;           // binary
+-    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP)
+-            || eOp == ocPercentSign)
+-        return 1;           // unary
++    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP && eOp != ocAnd && eOp != ocOr)
++        return 2;           // binary operators, compiler checked; OR and AND legacy but are functions
++    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP) || eOp == ocPercentSign)
++        return 1;           // unary operators, compiler checked
+     else if (SC_OPCODE_START_NO_PAR <= eOp && eOp < SC_OPCODE_STOP_NO_PAR)
+         return 0;           // no parameter
+-    else if (SC_OPCODE_START_1_PAR <= eOp && eOp < SC_OPCODE_STOP_1_PAR)
+-        return 1;           // one parameter
+     else if (FormulaCompiler::IsOpCodeJumpCommand( eOp ))
+         return 1;           // only the condition counts as parameter
+     else
+diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
+index b9d34cd080a6..d5d8588fe49a 100644
+--- a/sc/source/core/tool/interpr4.cxx
++++ b/sc/source/core/tool/interpr4.cxx
+@@ -4022,7 +4022,15 @@ StackVar ScInterpreter::Interpret()
+                 else if (sp >= pCur->GetParamCount())
+                     nStackBase = sp - pCur->GetParamCount();
+                 else
+-                    nStackBase = sp;    // underflow?!?
++                {
++                    SAL_WARN("sc.core", "Stack anomaly at " << aPos.Format(
++                                ScRefFlags::VALID | ScRefFlags::FORCE_DOC | ScRefFlags::TAB_3D, &mrDoc)
++                            << "  eOp: " << static_cast<int>(eOp)
++                            << "  params: " << static_cast<int>(pCur->GetParamCount())
++                            << "  nStackBase: " << nStackBase << "  sp: " << sp);
++                    nStackBase = sp;
++                    assert(!"underflow");
++                }
+             }
+ 
+             switch( eOp )
+-- 
+2.41.0
+
diff --git a/SOURCES/0001-URE-Library_boostrap-should-not-depend-on-Library_co.patch b/SOURCES/0001-URE-Library_boostrap-should-not-depend-on-Library_co.patch
new file mode 100644
index 0000000..46fda0d
--- /dev/null
+++ b/SOURCES/0001-URE-Library_boostrap-should-not-depend-on-Library_co.patch
@@ -0,0 +1,32 @@
+From 57b58d4fb85579a9aacbd6b2d7e389cce46f5fbc Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Mon, 9 May 2022 16:17:15 +0200
+Subject: [PATCH] URE Library_boostrap should not depend on Library_comphelper
+
+...and apparently doesn't need to, even though that dependency got added with
+6ffdc88e79904882e319bdd0b901e7491abae0b3 "Simplify Sequence iterations in
+shell..svgio"
+
+Change-Id: I7cb67dc48d11e426d5d5f7912eca13e25a32dbc5
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134079
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+---
+ stoc/Library_bootstrap.mk | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/stoc/Library_bootstrap.mk b/stoc/Library_bootstrap.mk
+index ca1f49618bb8..62e2360581db 100644
+--- a/stoc/Library_bootstrap.mk
++++ b/stoc/Library_bootstrap.mk
+@@ -26,7 +26,6 @@ $(eval $(call gb_Library_use_internal_bootstrap_api,bootstrap,\
+ ))
+ 
+ $(eval $(call gb_Library_use_libraries,bootstrap,\
+-    comphelper \
+     cppu \
+     cppuhelper \
+     reg \
+-- 
+2.40.1
+
diff --git a/SOURCES/0001-disable-script-dump.patch b/SOURCES/0001-disable-script-dump.patch
new file mode 100644
index 0000000..80a5eb9
--- /dev/null
+++ b/SOURCES/0001-disable-script-dump.patch
@@ -0,0 +1,99 @@
+From 78111bfd799914b4a39a9f3022f5028234c609bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 13 Feb 2023 13:56:10 +0000
+Subject: [PATCH] disable script dump
+
+Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986
+Tested-by: Jenkins
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051
+Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147256
+Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
+Reviewed-by: Andras Timar <andras.timar@collabora.com>
+(cherry picked from commit c948c8d3bb1433cde46319f3bb81693912371aea)
+---
+ .../source/drivers/hsqldb/HDriver.cxx         | 31 +++++++++++++++++++
+ external/hsqldb/UnpackedTarball_hsqldb.mk     |  1 +
+ .../hsqldb/patches/disable-dump-script.patch  | 14 +++++++++
+ 3 files changed, 46 insertions(+)
+ create mode 100644 external/hsqldb/patches/disable-dump-script.patch
+
+diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx
+index 6ff0f539407b..eee39911a255 100644
+--- a/connectivity/source/drivers/hsqldb/HDriver.cxx
++++ b/connectivity/source/drivers/hsqldb/HDriver.cxx
+@@ -290,6 +290,37 @@ namespace connectivity
+                         } // if ( xStream.is() )
+                         ::comphelper::disposeComponent(xStream);
+                     }
++
++                    // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces
++                    // in that bundled hsqldb 1.8.0 is patched to also reject them)
++                    //
++                    // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data
++                    // which seems to provide a builtin way to do this with contemporary hsqldb
++                    const OUString sScript( "script" );
++                    if (!bIsNewDatabase && xStorage->isStreamElement(sScript))
++                    {
++                        Reference<XStream > xStream = xStorage->openStreamElement(sScript, ElementModes::READ);
++                        if (xStream.is())
++                        {
++                            std::unique_ptr<SvStream> pStream(::utl::UcbStreamHelper::CreateStream(xStream));
++                            if (pStream)
++                            {
++                                OString sLine;
++                                while (pStream->ReadLine(sLine))
++                                {
++                                    OString sText = sLine.trim();
++                                    if (sText.startsWithIgnoreAsciiCase("SCRIPT"))
++                                    {
++                                        ::connectivity::SharedResources aResources;
++                                        sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath);
++                                        break;
++                                    }
++                                }
++                            }
++                        } // if ( xStream.is() )
++                        ::comphelper::disposeComponent(xStream);
++                    }
++
+                 }
+                 catch(Exception&)
+                 {
+diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk
+index cbba770f19a0..ed262cccf4ca 100644
+--- a/external/hsqldb/UnpackedTarball_hsqldb.mk
++++ b/external/hsqldb/UnpackedTarball_hsqldb.mk
+@@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\
+ 		external/hsqldb/patches/jdbc-4.1.patch \
+ 		external/hsqldb/patches/multipleResultSets.patch \
+ 	) \
++	external/hsqldb/patches/disable-dump-script.patch \
+ ))
+ 
+ # vim: set noet sw=4 ts=4:
+diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch
+new file mode 100644
+index 000000000000..401dd38abc9a
+--- /dev/null
++++ b/external/hsqldb/patches/disable-dump-script.patch
+@@ -0,0 +1,14 @@
++--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 11:08:11.297243034 +0000
+++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 13:49:17.973089433 +0000
++@@ -403,6 +403,11 @@
++                     throw Trace.error(Trace.INVALID_IDENTIFIER);
++                 }
++ 
+++                // added condition to avoid execution of spurious command in .script or .log file
+++                if (session.isProcessingScript() || session.isProcessingLog()) {
+++                    return new Result(ResultConstants.UPDATECOUNT);
+++                }
+++
++                 dsw = new ScriptWriterText(database, token, true, true, true);
++ 
++                 dsw.writeAll();
+-- 
+2.41.0
+
diff --git a/SOURCES/0001-set-Referer-on-loading-IFrames.patch b/SOURCES/0001-set-Referer-on-loading-IFrames.patch
new file mode 100644
index 0000000..80f78e9
--- /dev/null
+++ b/SOURCES/0001-set-Referer-on-loading-IFrames.patch
@@ -0,0 +1,91 @@
+From afc69ae524da5f8fad53d30e5c9ebaa458679732 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 11 Apr 2023 10:13:37 +0100
+Subject: [PATCH 1/3] set Referer on loading IFrames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+so tools, options, security, options,
+"block any links from document not..."
+applies to their contents.
+
+Change-Id: I04839aea6b07a4a76ac147a85045939ccd9c3c79
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150221
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150751
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit acff9ca0579333b45d10ae5f8cd48172f563dddd)
+(cherry picked from commit 04c8176fb40d2eb983aa0bd0a6ce65804d3f6ecd)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152112
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+
+(cherry picked from commit 4e2a04f66eabd2132f9c801c060828adcd20ca1a)
+Conflicts:
+	sfx2/source/doc/iframe.cxx
+---
+ sfx2/source/doc/iframe.cxx | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 3f9036a79b04..b9495b8fd311 100644
+--- a/sfx2/source/doc/iframe.cxx
++++ b/sfx2/source/doc/iframe.cxx
+@@ -33,10 +33,12 @@
+ #include <com/sun/star/ui/dialogs/XExecutableDialog.hpp>
+ #include <com/sun/star/embed/XEmbeddedObject.hpp>
+ 
++#include <comphelper/propertyvalue.hxx>
+ #include <cppuhelper/implbase.hxx>
+ #include <cppuhelper/supportsservice.hxx>
+ #include <officecfg/Office/Common.hxx>
+ #include <svl/itemprop.hxx>
++#include <sfx2/docfile.hxx>
+ #include <sfx2/frmdescr.hxx>
+ #include <sfx2/objsh.hxx>
+ #include <sfx2/sfxdlg.hxx>
+@@ -164,14 +166,19 @@ sal_Bool SAL_CALL IFrameObject::load(
+         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+         xTrans->parseStrict( aTargetURL );
+ 
++        uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
++        SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
++
+         if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+         {
+-            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+-            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+             if (pDoc && !pDoc->AdjustMacroMode())
+                 return false;
+         }
+ 
++        OUString sReferer;
++        if (pDoc && pDoc->HasName())
++            sReferer = pDoc->GetMedium()->GetName();
++
+         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+@@ -194,12 +201,11 @@ sal_Bool SAL_CALL IFrameObject::load(
+         if ( xFramesSupplier.is() )
+             mxFrame->setCreator( xFramesSupplier );
+ 
+-        uno::Sequence < beans::PropertyValue > aProps(2);
+-        aProps[0].Name = "PluginMode";
+-        aProps[0].Value <<= sal_Int16(2);
+-        aProps[1].Name = "ReadOnly";
+-        aProps[1].Value <<= true;
+-
++        uno::Sequence < beans::PropertyValue > aProps{
++            comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
++            comphelper::makePropertyValue("ReadOnly", true),
++            comphelper::makePropertyValue("Referer", sReferer)
++        };
+         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
+         if ( xDisp.is() )
+             xDisp->dispatch( aTargetURL, aProps );
+-- 
+2.41.0
+
diff --git a/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch b/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
new file mode 100644
index 0000000..8369329
--- /dev/null
+++ b/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
@@ -0,0 +1,72 @@
+From 94b5b99c96ad80e659ffa8dbe8045b65ab4cc791 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Fri, 17 Feb 2023 12:03:54 +0100
+Subject: [PATCH 2/3] Stack check safety belt before fishing in muddy waters
+
+Have it hit hard in debug builds.
+
+Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
+---
+ sc/source/core/inc/interpre.hxx  | 12 ++++++++++++
+ sc/source/core/tool/interpr1.cxx |  4 ++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
+index 4e986daf8453..3bcc9ef19fc2 100644
+--- a/sc/source/core/inc/interpre.hxx
++++ b/sc/source/core/inc/interpre.hxx
+@@ -235,6 +235,7 @@ private:
+     inline bool MustHaveParamCount( short nAct, short nMust );
+     inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
+     inline bool MustHaveParamCountMin( short nAct, short nMin );
++    inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
+     void PushParameterExpected();
+     void PushIllegalParameter();
+     void PushIllegalArgument();
+@@ -1089,6 +1090,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin )
+     return false;
+ }
+ 
++inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin )
++{
++    assert(sp >= nAct);
++    if (sp < nAct)
++    {
++        PushParameterExpected();
++        return false;
++    }
++    return MustHaveParamCountMin( nAct, nMin);
++}
++
+ inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
+ {
+     if (!std::isfinite( fVal))
+diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
+index 4f2789160a1c..5e2f36685024 100644
+--- a/sc/source/core/tool/interpr1.cxx
++++ b/sc/source/core/tool/interpr1.cxx
+@@ -7547,7 +7547,7 @@ void ScInterpreter::ScVLookup()
+ void ScInterpreter::ScSubTotal()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( !MustHaveParamCountMin( nParamCount, 2 ) )
++    if ( !MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
+         return;
+ 
+     // We must fish the 1st parameter deep from the stack! And push it on top.
+@@ -7594,7 +7594,7 @@ void ScInterpreter::ScSubTotal()
+ void ScInterpreter::ScAggregate()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( !MustHaveParamCountMin( nParamCount, 3 ) )
++    if ( !MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
+         return;
+ 
+     const FormulaError nErr = nGlobalError;
+-- 
+2.41.0
+
diff --git a/SOURCES/0002-put-floating-frames-under-managed-links-control.patch b/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
new file mode 100644
index 0000000..fbb6728
--- /dev/null
+++ b/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
@@ -0,0 +1,896 @@
+From ed22ee21fdeaef43d82c4a18c5274e42fe85bd35 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 13 Apr 2023 11:31:17 +0100
+Subject: [PATCH 2/3] put floating frames under managed links control
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+like we do for sections and ole objects that link to their content
+
+individual commits in trunk are:
+
+extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse
+
+no behaviour change intended
+
+Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825)
+
+use parent window as dialog parent
+
+it makes no odds, but is more convenient for upcoming modification
+
+Change-Id: Ibc5333b137d2da089b3b701ff615c6ddf43063d0
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99)
+
+adjust IFrameObject so it could reuse mxFrame for a reload of content
+
+Change-Id: I7eec3132a23faafd9a2878215a0a117a67bc9bf2
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206)
+
+query getUserAllowsLinkUpdate for the case of content in a floating frame
+
+similarly to how it works for the more common "normal" embedded objects
+
+Change-Id: I83e38dfa2f84907c2de9680e91f779d34864a9ad
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7)
+
+add a route to get writer Floating Frame links under 'manage links'
+
+Change-Id: If90ff71d6a96342574799312f764badaf97980eb
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be)
+
+allow SvxOle2Shape::resetModifiedState to survive having no SdrObject
+
+Change-Id: Iea059262c124e3f44249e49b4189732310d28156
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c)
+
+create the FloatingFrameShape in a separate step to inserting it
+
+this is derived from the path taken by the AddShape(const OUString&)
+function for this case. No change in behavior is intended.
+
+Change-Id: Id09ae0c65a55a37743ad7c184070fb8dd97d8a7f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024)
+
+add a route to get calc Floating Frame links under 'manage links'
+
+much harder than writer because the organization and ordering
+of properties and object activation etc is different.
+
+This ended up ugly, but functions.
+
+We set FrameURL before AddShape, we have to do it again later because it
+gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
+FrameURL to exist when AddShape triggers SetPersistName which itself
+triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
+know what URL will end up being used. So bodge this by setting FrameURL
+to the temp pre-SdrOle2Obj attached properties and we can smuggle it
+eventually into SdrOle2Obj::SetPersistName at the right point after
+PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
+in order to inform the link manager that this is an IFrame that links to
+a URL
+
+Change-Id: I67fc199fef9e67fa12ca7873f0fe12137aa16d8f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152144
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit e3d1c8f1ad871d664886319a47bee161e673de6c)
+---
+ .../source/commonembedding/embedobj.cxx       |  60 +++++-----
+ .../source/commonembedding/specialobject.cxx  |   9 ++
+ embeddedobj/source/inc/commonembobj.hxx       |   3 +
+ embeddedobj/source/inc/specialobject.hxx      |   6 +
+ include/svx/svdoole2.hxx                      |  17 ++-
+ include/svx/unoshape.hxx                      |   2 +
+ sc/source/ui/docshell/documentlinkmgr.cxx     |   9 +-
+ sfx2/source/doc/iframe.cxx                    |  55 +++++----
+ svx/source/svdraw/svdoole2.cxx                | 104 +++++++++++++++---
+ svx/source/unodraw/shapeimpl.hxx              |   5 +
+ svx/source/unodraw/unoshap4.cxx               |  23 +++-
+ sw/inc/ndole.hxx                              |   4 +-
+ sw/source/core/ole/ndole.cxx                  |  89 +++++++++++++--
+ xmloff/source/draw/ximpshap.cxx               |  29 ++++-
+ xmloff/source/draw/ximpshap.hxx               |   2 +
+ 15 files changed, 331 insertions(+), 86 deletions(-)
+
+diff --git a/embeddedobj/source/commonembedding/embedobj.cxx b/embeddedobj/source/commonembedding/embedobj.cxx
+index ffa2a0789be0..3bd8d84d09e2 100644
+--- a/embeddedobj/source/commonembedding/embedobj.cxx
++++ b/embeddedobj/source/commonembedding/embedobj.cxx
+@@ -161,6 +161,37 @@ void OCommonEmbeddedObject::StateChangeNotification_Impl( bool bBeforeChange, sa
+     rGuard.reset();
+ }
+ 
++void OCommonEmbeddedObject::SetInplaceActiveState()
++{
++    if ( !m_xClientSite.is() )
++        throw embed::WrongStateException( "client site not set, yet", *this );
++
++    uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
++    if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
++        throw embed::WrongStateException(); //TODO: can't activate inplace
++    xInplaceClient->activatingInplace();
++
++    uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
++
++    m_xClientWindow = xClientWindowSupplier->getWindow();
++    m_aOwnRectangle = xInplaceClient->getPlacement();
++    m_aClipRectangle = xInplaceClient->getClipRectangle();
++    awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
++
++    // create own window based on the client window
++    // place and resize the window according to the rectangles
++    uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
++
++    // dispatch provider may not be provided
++    uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
++    bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
++    m_nObjectState = embed::EmbedStates::INPLACE_ACTIVE;
++    if ( !bOk )
++    {
++        SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
++        throw embed::WrongStateException(); //TODO: can't activate inplace
++    }
++}
+ 
+ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
+ {
+@@ -234,34 +265,7 @@ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
+         {
+             if ( nNextState == embed::EmbedStates::INPLACE_ACTIVE )
+             {
+-                if ( !m_xClientSite.is() )
+-                    throw embed::WrongStateException( "client site not set, yet", *this );
+-
+-                uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
+-                if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
+-                    throw embed::WrongStateException(); //TODO: can't activate inplace
+-                xInplaceClient->activatingInplace();
+-
+-                uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
+-
+-                m_xClientWindow = xClientWindowSupplier->getWindow();
+-                m_aOwnRectangle = xInplaceClient->getPlacement();
+-                m_aClipRectangle = xInplaceClient->getClipRectangle();
+-                awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
+-
+-                // create own window based on the client window
+-                // place and resize the window according to the rectangles
+-                uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
+-
+-                // dispatch provider may not be provided
+-                uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
+-                bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
+-                m_nObjectState = nNextState;
+-                if ( !bOk )
+-                {
+-                    SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
+-                    throw embed::WrongStateException(); //TODO: can't activate inplace
+-                }
++                SetInplaceActiveState();
+             }
+             else if ( nNextState == embed::EmbedStates::ACTIVE )
+             {
+diff --git a/embeddedobj/source/commonembedding/specialobject.cxx b/embeddedobj/source/commonembedding/specialobject.cxx
+index 683fe0aab3f2..c17a39accf2c 100644
+--- a/embeddedobj/source/commonembedding/specialobject.cxx
++++ b/embeddedobj/source/commonembedding/specialobject.cxx
+@@ -47,6 +47,7 @@ uno::Any SAL_CALL OSpecialEmbeddedObject::queryInterface( const uno::Type& rType
+     uno::Any aReturn = ::cppu::queryInterface( rType,
+                                         static_cast< embed::XEmbeddedObject* >( this ),
+                                         static_cast< embed::XInplaceObject* >( this ),
++                                        static_cast< embed::XCommonEmbedPersist* >( static_cast< embed::XEmbedPersist* >( this ) ),
+                                         static_cast< embed::XVisualObject* >( this ),
+                                         static_cast< embed::XClassifiedObject* >( this ),
+                                         static_cast< embed::XComponentSupplier* >( this ),
+@@ -160,4 +161,12 @@ void SAL_CALL OSpecialEmbeddedObject::doVerb( sal_Int32 nVerbID )
+         OCommonEmbeddedObject::doVerb( nVerbID );
+ }
+ 
++void SAL_CALL OSpecialEmbeddedObject::reload(
++                const uno::Sequence< beans::PropertyValue >&,
++                const uno::Sequence< beans::PropertyValue >&)
++{
++    // Allow IFrames to reload their content
++    SetInplaceActiveState();
++}
++
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/embeddedobj/source/inc/commonembobj.hxx b/embeddedobj/source/inc/commonembobj.hxx
+index 1b020f430855..dbed7c26f28c 100644
+--- a/embeddedobj/source/inc/commonembobj.hxx
++++ b/embeddedobj/source/inc/commonembobj.hxx
+@@ -231,6 +231,9 @@ private:
+                     const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
+                     const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs );
+ 
++protected:
++    void SetInplaceActiveState();
++
+ public:
+     OCommonEmbeddedObject(
+         const css::uno::Reference< css::uno::XComponentContext >& rxContext,
+diff --git a/embeddedobj/source/inc/specialobject.hxx b/embeddedobj/source/inc/specialobject.hxx
+index 5c467b97a379..0b5e3ca23e9f 100644
+--- a/embeddedobj/source/inc/specialobject.hxx
++++ b/embeddedobj/source/inc/specialobject.hxx
+@@ -47,6 +47,12 @@ public:
+     virtual void SAL_CALL changeState( sal_Int32 nNewState ) override;
+ 
+     virtual void SAL_CALL doVerb( sal_Int32 nVerbID ) override;
++
++// XCommonEmbedPersist
++
++    virtual void SAL_CALL reload(
++                const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
++                const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs ) override;
+ };
+ 
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/include/svx/svdoole2.hxx b/include/svx/svdoole2.hxx
+index 8c209ce7f281..342b5370c239 100644
+--- a/include/svx/svdoole2.hxx
++++ b/include/svx/svdoole2.hxx
+@@ -42,6 +42,7 @@ namespace frame { class XModel; }
+ namespace svt { class EmbeddedObjectRef; }
+ 
+ class SdrOle2ObjImpl;
++class SvxOle2Shape;
+ 
+ class SVXCORE_DLLPUBLIC SdrOle2Obj : public SdrRectObj
+ {
+@@ -49,7 +50,7 @@ private:
+     std::unique_ptr<SdrOle2ObjImpl> mpImpl;
+ 
+ private:
+-    SVX_DLLPRIVATE void Connect_Impl();
++    SVX_DLLPRIVATE void Connect_Impl(SvxOle2Shape* pCreator = nullptr);
+     SVX_DLLPRIVATE void Disconnect_Impl();
+     SVX_DLLPRIVATE void AddListeners_Impl();
+     SVX_DLLPRIVATE void RemoveListeners_Impl();
+@@ -105,7 +106,7 @@ public:
+     // OLE object has got a separate PersistName member now;
+     // !!! use ::SetPersistName( ... ) only, if you know what you do !!!
+     const OUString& GetPersistName() const;
+-    void        SetPersistName( const OUString& rPersistName );
++    void        SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator = nullptr );
+ 
+     // One can add an application name to a SdrOle2Obj, which can be queried for
+     // later on (SD needs this for presentation objects).
+@@ -153,7 +154,7 @@ public:
+                                          sal_Int64 nAspect );
+     static bool Unload( const css::uno::Reference< css::embed::XEmbeddedObject >& xObj, sal_Int64 nAspect );
+     bool Unload();
+-    void Connect();
++    void Connect(SvxOle2Shape* pCreator = nullptr);
+     void Disconnect();
+     void ObjectLoaded();
+ 
+@@ -200,6 +201,16 @@ public:
+     void                Connect() { GetRealObject(); }
+ };
+ 
++class SVXCORE_DLLPUBLIC SdrIFrameLink final : public sfx2::SvBaseLink
++{
++    SdrOle2Obj* m_pObject;
++
++public:
++    explicit SdrIFrameLink(SdrOle2Obj* pObject);
++    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
++        const OUString& rMimeType, const css::uno::Any & rValue ) override;
++};
++
+ #endif // INCLUDED_SVX_SVDOOLE2_HXX
+ 
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/include/svx/unoshape.hxx b/include/svx/unoshape.hxx
+index 1f948f50574b..5fe64331842c 100644
+--- a/include/svx/unoshape.hxx
++++ b/include/svx/unoshape.hxx
+@@ -607,6 +607,8 @@ public:
+     bool createObject( const SvGlobalName &aClassName );
+ 
+     void createLink( const OUString& aLinkURL );
++
++    virtual OUString GetAndClearInitialFrameURL();
+ };
+ 
+ 
+diff --git a/sc/source/ui/docshell/documentlinkmgr.cxx b/sc/source/ui/docshell/documentlinkmgr.cxx
+index 1796b02b5434..fce782935949 100644
+--- a/sc/source/ui/docshell/documentlinkmgr.cxx
++++ b/sc/source/ui/docshell/documentlinkmgr.cxx
+@@ -142,7 +142,7 @@ bool DocumentLinkManager::hasDdeOrOleOrWebServiceLinks(bool bDde, bool bOle, boo
+         sfx2::SvBaseLink* pBase = rLink.get();
+         if (bDde && dynamic_cast<ScDdeLink*>(pBase))
+             return true;
+-        if (bOle && dynamic_cast<SdrEmbedObjectLink*>(pBase))
++        if (bOle && (dynamic_cast<SdrEmbedObjectLink*>(pBase) || dynamic_cast<SdrIFrameLink*>(pBase)))
+             return true;
+         if (bWebService && dynamic_cast<ScWebServiceLink*>(pBase))
+             return true;
+@@ -173,6 +173,13 @@ bool DocumentLinkManager::updateDdeOrOleOrWebServiceLinks(weld::Window* pWin)
+             continue;
+         }
+ 
++        SdrIFrameLink* pIFrameLink = dynamic_cast<SdrIFrameLink*>(pBase);
++        if (pIFrameLink)
++        {
++            pIFrameLink->Update();
++            continue;
++        }
++
+         ScWebServiceLink* pWebserviceLink = dynamic_cast<ScWebServiceLink*>(pBase);
+         if (pWebserviceLink)
+         {
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index b9495b8fd311..73030f151359 100644
+--- a/sfx2/source/doc/iframe.cxx
++++ b/sfx2/source/doc/iframe.cxx
+@@ -175,31 +175,46 @@ sal_Bool SAL_CALL IFrameObject::load(
+                 return false;
+         }
+ 
++        bool bUpdateAllowed(true);
++        if (pDoc)
++        {
++            // perhaps should only check for file targets, but lets default to making it strong
++            // unless there is a known need to distinguish
++            comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
++            bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
++        }
++        if (!bUpdateAllowed)
++            return false;
++
+         OUString sReferer;
+         if (pDoc && pDoc->HasName())
+             sReferer = pDoc->GetMedium()->GetName();
+ 
+-        DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+-        VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+-        VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+-        pWin->SetSizePixel( pParent->GetOutputSizePixel() );
+-        pWin->SetBackground();
+-        pWin->Show();
+-
+-        uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
+-        xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
++        uno::Reference<css::awt::XWindow> xParentWindow(xFrame->getContainerWindow());
+ 
+-        // we must destroy the IFrame before the parent is destroyed
+-        xWindow->addEventListener( this );
+-
+-        mxFrame = frame::Frame::create( mxContext );
+-        uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
+-        mxFrame->initialize( xWin );
+-        mxFrame->setName( maFrmDescr.GetName() );
+-
+-        uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
+-        if ( xFramesSupplier.is() )
+-            mxFrame->setCreator( xFramesSupplier );
++        if (!mxFrame.is())
++        {
++            VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow(xParentWindow);
++            VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
++            pWin->SetSizePixel( pParent->GetOutputSizePixel() );
++            pWin->SetBackground();
++            pWin->Show();
++
++            uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
++            xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
++
++            // we must destroy the IFrame before the parent is destroyed
++            xWindow->addEventListener( this );
++
++            mxFrame = frame::Frame::create( mxContext );
++            uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
++            mxFrame->initialize( xWin );
++            mxFrame->setName( maFrmDescr.GetName() );
++
++            uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
++            if ( xFramesSupplier.is() )
++                mxFrame->setCreator( xFramesSupplier );
++        }
+ 
+         uno::Sequence < beans::PropertyValue > aProps{
+             comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
+diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
+index 23eb06465e87..de1ac41beb13 100644
+--- a/svx/source/svdraw/svdoole2.cxx
++++ b/svx/source/svdraw/svdoole2.cxx
+@@ -67,6 +67,7 @@
+ #include <sdr/contact/viewcontactofsdrole2obj.hxx>
+ #include <svx/svdograf.hxx>
+ #include <sdr/properties/oleproperties.hxx>
++#include <svx/unoshape.hxx>
+ #include <svx/xlineit0.hxx>
+ #include <svx/xlnclit.hxx>
+ #include <svx/xbtmpit.hxx>
+@@ -591,6 +592,35 @@ void SdrEmbedObjectLink::Closed()
+     SvBaseLink::Closed();
+ }
+ 
++SdrIFrameLink::SdrIFrameLink(SdrOle2Obj* pObject)
++    : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
++    , m_pObject(pObject)
++{
++    SetSynchron( false );
++}
++
++::sfx2::SvBaseLink::UpdateResult SdrIFrameLink::DataChanged(
++    const OUString&, const uno::Any& )
++{
++    uno::Reference<embed::XEmbeddedObject> xObject = m_pObject->GetObjRef();
++    uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
++    if (xPersObj.is())
++    {
++        // let the IFrameObject reload the link
++        try
++        {
++            xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
++        }
++        catch (const uno::Exception&)
++        {
++        }
++
++        m_pObject->SetChanged();
++    }
++
++    return SUCCESS;
++}
++
+ class SdrOle2ObjImpl
+ {
+ public:
+@@ -608,7 +638,7 @@ public:
+     bool mbLoadingOLEObjectFailed:1; // New local var to avoid repeated loading if load of OLE2 fails
+     bool mbConnected:1;
+ 
+-    SdrEmbedObjectLink* mpObjectLink;
++    sfx2::SvBaseLink* mpObjectLink;
+     OUString maLinkURL;
+ 
+     rtl::Reference<SvxUnoShapeModifyListener> mxModifyListener;
+@@ -808,7 +838,7 @@ bool SdrOle2Obj::IsEmpty() const
+     return !mpImpl->mxObjRef.is();
+ }
+ 
+-void SdrOle2Obj::Connect()
++void SdrOle2Obj::Connect(SvxOle2Shape* pCreator)
+ {
+     if( IsEmptyPresObj() )
+         return;
+@@ -821,7 +851,7 @@ void SdrOle2Obj::Connect()
+         return;
+     }
+ 
+-    Connect_Impl();
++    Connect_Impl(pCreator);
+     AddListeners_Impl();
+ }
+ 
+@@ -921,24 +951,51 @@ void SdrOle2Obj::CheckFileLink_Impl()
+ 
+     try
+     {
+-        uno::Reference< embed::XLinkageSupport > xLinkSupport( mpImpl->mxObjRef.GetObject(), uno::UNO_QUERY );
++        uno::Reference<embed::XEmbeddedObject> xObject = mpImpl->mxObjRef.GetObject();
++        if (!xObject)
++            return;
+ 
+-        if ( xLinkSupport.is() && xLinkSupport->isLink() )
+-        {
+-            OUString aLinkURL = xLinkSupport->getLinkURL();
++        bool bIFrame = false;
+ 
+-            if ( !aLinkURL.isEmpty() )
++        OUString aLinkURL;
++        uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
++        if (xLinkSupport)
++        {
++            if (xLinkSupport->isLink())
++                aLinkURL = xLinkSupport->getLinkURL();
++        }
++        else
++        {
++            // get IFrame (Floating Frames) listed and updatable from the
++            // manage links dialog
++            SvGlobalName aClassId(xObject->getClassID());
++            if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
+             {
+-                // this is a file link so the model link manager should handle it
+-                sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
++                uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
++                if (xSet.is())
++                    xSet->getPropertyValue("FrameURL") >>= aLinkURL;
++                bIFrame = true;
++            }
++        }
++
++        if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
++        {
++            sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
+ 
+-                if ( pLinkManager )
++            if ( pLinkManager )
++            {
++                SdrEmbedObjectLink* pEmbedObjectLink = nullptr;
++                if (!bIFrame)
+                 {
+-                    mpImpl->mpObjectLink = new SdrEmbedObjectLink( this );
+-                    mpImpl->maLinkURL = aLinkURL;
+-                    pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, sfx2::SvBaseLinkObjectType::ClientOle, aLinkURL );
+-                    mpImpl->mpObjectLink->Connect();
++                    pEmbedObjectLink = new SdrEmbedObjectLink(this);
++                    mpImpl->mpObjectLink = pEmbedObjectLink;
+                 }
++                else
++                    mpImpl->mpObjectLink = new SdrIFrameLink(this);
++                mpImpl->maLinkURL = aLinkURL;
++                pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, sfx2::SvBaseLinkObjectType::ClientOle, aLinkURL );
++                if (pEmbedObjectLink)
++                    pEmbedObjectLink->Connect();
+             }
+         }
+     }
+@@ -948,7 +1005,7 @@ void SdrOle2Obj::CheckFileLink_Impl()
+     }
+ }
+ 
+-void SdrOle2Obj::Connect_Impl()
++void SdrOle2Obj::Connect_Impl(SvxOle2Shape* pCreator)
+ {
+     if(mpImpl->aPersistName.isEmpty() )
+         return;
+@@ -989,6 +1046,17 @@ void SdrOle2Obj::Connect_Impl()
+             }
+         }
+ 
++        if (pCreator)
++        {
++            OUString sFrameURL(pCreator->GetAndClearInitialFrameURL());
++            if (!sFrameURL.isEmpty() && svt::EmbeddedObjectRef::TryRunningState(mpImpl->mxObjRef.GetObject()))
++            {
++                uno::Reference<beans::XPropertySet> xSet(mpImpl->mxObjRef->getComponent(), uno::UNO_QUERY);
++                if (xSet.is())
++                    xSet->setPropertyValue("FrameURL", uno::Any(sFrameURL));
++            }
++        }
++
+         if ( mpImpl->mxObjRef.is() )
+         {
+             if ( !mpImpl->mxLightClient.is() )
+@@ -1301,14 +1369,14 @@ SdrObjectUniquePtr SdrOle2Obj::getFullDragClone() const
+     return createSdrGrafObjReplacement(false);
+ }
+ 
+-void SdrOle2Obj::SetPersistName( const OUString& rPersistName )
++void SdrOle2Obj::SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator )
+ {
+     DBG_ASSERT( mpImpl->aPersistName.isEmpty(), "Persist name changed!");
+ 
+     mpImpl->aPersistName = rPersistName;
+     mpImpl->mbLoadingOLEObjectFailed = false;
+ 
+-    Connect();
++    Connect(pCreator);
+     SetChanged();
+ }
+ 
+diff --git a/svx/source/unodraw/shapeimpl.hxx b/svx/source/unodraw/shapeimpl.hxx
+index a1a4e6963020..4381094d380a 100644
+--- a/svx/source/unodraw/shapeimpl.hxx
++++ b/svx/source/unodraw/shapeimpl.hxx
+@@ -64,8 +64,11 @@ public:
+ 
+     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
+ };
++
+ class SvxFrameShape : public SvxOle2Shape
+ {
++private:
++    OUString m_sInitialFrameURL;
+ protected:
+     // override these for special property handling in subcasses. Return true if property is handled
+     virtual bool setPropertyValueImpl( const OUString& rName, const SfxItemPropertySimpleEntry* pProperty, const css::uno::Any& rValue ) override;
+@@ -82,6 +85,8 @@ public:
+     virtual void SAL_CALL setPropertyValues( const css::uno::Sequence< OUString >& aPropertyNames, const css::uno::Sequence< css::uno::Any >& aValues ) override;
+ 
+     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
++
++    virtual OUString GetAndClearInitialFrameURL() override;
+ };
+ 
+ 
+diff --git a/svx/source/unodraw/unoshap4.cxx b/svx/source/unodraw/unoshap4.cxx
+index 658cb2c8fd6c..e6bbe51ee1e0 100644
+--- a/svx/source/unodraw/unoshap4.cxx
++++ b/svx/source/unodraw/unoshap4.cxx
+@@ -174,7 +174,7 @@ bool SvxOle2Shape::setPropertyValueImpl( const OUString& rName, const SfxItemPro
+ #else
+             pOle = static_cast<SdrOle2Obj*>(GetSdrObject());
+ #endif
+-            pOle->SetPersistName( aPersistName );
++            pOle->SetPersistName( aPersistName, this );
+             return true;
+         }
+         break;
+@@ -495,10 +495,11 @@ void SvxOle2Shape::createLink( const OUString& aLinkURL )
+ 
+ void SvxOle2Shape::resetModifiedState()
+ {
+-    ::comphelper::IEmbeddedHelper* pPersist = GetSdrObject()->getSdrModelFromSdrObject().GetPersist();
++    SdrObject* pObject = GetSdrObject();
++    ::comphelper::IEmbeddedHelper* pPersist = pObject ? pObject->getSdrModelFromSdrObject().GetPersist() : nullptr;
+     if( pPersist && !pPersist->isEnableSetModified() )
+     {
+-        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >( GetSdrObject() );
++        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >(pObject);
+         if( pOle && !pOle->IsEmpty() )
+         {
+             uno::Reference < util::XModifiable > xMod( pOle->GetObjRef(), uno::UNO_QUERY );
+@@ -548,6 +549,11 @@ SvGlobalName SvxOle2Shape::GetClassName_Impl(OUString& rHexCLSID)
+     return aClassName;
+ }
+ 
++OUString SvxOle2Shape::GetAndClearInitialFrameURL()
++{
++    return OUString();
++}
++
+ SvxAppletShape::SvxAppletShape(SdrObject* pObject)
+     : SvxOle2Shape( pObject, getSvxMapProvider().GetMap(SVXMAP_APPLET), getSvxMapProvider().GetPropertySet(SVXMAP_APPLET, SdrObject::GetGlobalDrawObjectItemPool())  )
+ {
+@@ -701,8 +707,19 @@ SvxFrameShape::~SvxFrameShape() throw()
+ {
+ }
+ 
++OUString SvxFrameShape::GetAndClearInitialFrameURL()
++{
++    OUString sRet(m_sInitialFrameURL);
++    m_sInitialFrameURL.clear();
++    return sRet;
++}
++
+ void SvxFrameShape::Create( SdrObject* pNewObj, SvxDrawPage* pNewPage )
+ {
++    uno::Reference<beans::XPropertySet> xSet(static_cast<OWeakObject *>(this), uno::UNO_QUERY);
++    if (xSet)
++        xSet->getPropertyValue("FrameURL") >>= m_sInitialFrameURL;
++
+     SvxShape::Create( pNewObj, pNewPage );
+     const SvGlobalName aIFrameClassId( SO3_IFRAME_CLASSID );
+     createObject(aIFrameClassId);
+diff --git a/sw/inc/ndole.hxx b/sw/inc/ndole.hxx
+index 7c07c2656b44..649b300e9be8 100644
+--- a/sw/inc/ndole.hxx
++++ b/sw/inc/ndole.hxx
+@@ -28,7 +28,7 @@ class SwGrfFormatColl;
+ class SwDoc;
+ class SwOLENode;
+ class SwOLEListener_Impl;
+-class SwEmbedObjectLink;
++namespace sfx2 { class SvBaseLink; }
+ class DeflateData;
+ 
+ class SW_DLLPUBLIC SwOLEObj
+@@ -90,7 +90,7 @@ class SW_DLLPUBLIC SwOLENode: public SwNoTextNode
+     bool   mbOLESizeInvalid; /**< Should be considered at SwDoc::PrtOLENotify
+                                    (e.g. copied). Is not persistent. */
+ 
+-    SwEmbedObjectLink*  mpObjectLink;
++    sfx2::SvBaseLink*  mpObjectLink;
+     OUString maLinkURL;
+ 
+     SwOLENode(  const SwNodeIndex &rWhere,
+diff --git a/sw/source/core/ole/ndole.cxx b/sw/source/core/ole/ndole.cxx
+index 74ceed65d2e0..02fc31daf550 100644
+--- a/sw/source/core/ole/ndole.cxx
++++ b/sw/source/core/ole/ndole.cxx
+@@ -147,6 +147,8 @@ void SAL_CALL SwOLEListener_Impl::disposing( const lang::EventObject& )
+ // TODO/LATER: actually SwEmbedObjectLink should be used here, but because different objects are used to control
+ //             embedded object different link objects with the same functionality had to be implemented
+ 
++namespace {
++
+ class SwEmbedObjectLink : public sfx2::SvBaseLink
+ {
+     SwOLENode*          pOleNode;
+@@ -209,6 +211,44 @@ void SwEmbedObjectLink::Closed()
+     SvBaseLink::Closed();
+ }
+ 
++class SwIFrameLink : public sfx2::SvBaseLink
++{
++    SwOLENode* m_pOleNode;
++
++public:
++    explicit SwIFrameLink(SwOLENode* pNode)
++        : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
++        , m_pOleNode(pNode)
++    {
++        SetSynchron( false );
++    }
++
++    ::sfx2::SvBaseLink::UpdateResult DataChanged(
++        const OUString&, const uno::Any& )
++    {
++        uno::Reference<embed::XEmbeddedObject> xObject = m_pOleNode->GetOLEObj().GetOleRef();
++        uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
++        if (xPersObj.is())
++        {
++            // let the IFrameObject reload the link
++            try
++            {
++                xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
++            }
++            catch (const uno::Exception&)
++            {
++            }
++
++            m_pOleNode->SetChanged();
++        }
++
++        return SUCCESS;
++    }
++
++};
++
++}
++
+ SwOLENode::SwOLENode( const SwNodeIndex &rWhere,
+                     const svt::EmbeddedObjectRef& xObj,
+                     SwGrfFormatColl *pGrfColl,
+@@ -607,18 +647,49 @@ void SwOLENode::CheckFileLink_Impl()
+ 
+     try
+     {
+-        uno::Reference< embed::XLinkageSupport > xLinkSupport( maOLEObj.m_xOLERef.GetObject(), uno::UNO_QUERY_THROW );
+-        if ( xLinkSupport->isLink() )
++        uno::Reference<embed::XEmbeddedObject> xObject = maOLEObj.m_xOLERef.GetObject();
++        if (!xObject)
++            return;
++
++        bool bIFrame = false;
++
++        OUString aLinkURL;
++        uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
++        if (xLinkSupport)
+         {
+-            const OUString aLinkURL = xLinkSupport->getLinkURL();
+-            if ( !aLinkURL.isEmpty() )
++            if (xLinkSupport->isLink())
++                aLinkURL = xLinkSupport->getLinkURL();
++        }
++        else
++        {
++            // get IFrame (Floating Frames) listed and updatable from the
++            // manage links dialog
++            SvGlobalName aClassId(xObject->getClassID());
++            if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
++            {
++                uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
++                if (xSet.is())
++                    xSet->getPropertyValue("FrameURL") >>= aLinkURL;
++                bIFrame = true;
++            }
++        }
++
++        if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
++        {
++            SwEmbedObjectLink* pEmbedObjectLink = nullptr;
++            if (!bIFrame)
++            {
++                pEmbedObjectLink = new SwEmbedObjectLink(this);
++                mpObjectLink = pEmbedObjectLink;
++            }
++            else
+             {
+-                // this is a file link so the model link manager should handle it
+-                mpObjectLink = new SwEmbedObjectLink( this );
+-                maLinkURL = aLinkURL;
+-                GetDoc().getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, sfx2::SvBaseLinkObjectType::ClientOle, aLinkURL );
+-                mpObjectLink->Connect();
++                mpObjectLink = new SwIFrameLink(this);
+             }
++            maLinkURL = aLinkURL;
++            GetDoc().getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, sfx2::SvBaseLinkObjectType::ClientOle, aLinkURL );
++            if (pEmbedObjectLink)
++                pEmbedObjectLink->Connect();
+         }
+     }
+     catch( uno::Exception& )
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index 4afa4e039776..3885f3b9219f 100644
+--- a/xmloff/source/draw/ximpshap.cxx
++++ b/xmloff/source/draw/ximpshap.cxx
+@@ -3210,9 +3210,35 @@ SdXMLFloatingFrameShapeContext::~SdXMLFloatingFrameShapeContext()
+ {
+ }
+ 
++uno::Reference<drawing::XShape> SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape() const
++{
++    uno::Reference<lang::XMultiServiceFactory> xServiceFact(GetImport().GetModel(), uno::UNO_QUERY);
++    if (!xServiceFact.is())
++        return nullptr;
++    uno::Reference<drawing::XShape> xShape(
++            xServiceFact->createInstance("com.sun.star.drawing.FrameShape"), uno::UNO_QUERY);
++    return xShape;
++}
++
+ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< css::xml::sax::XAttributeList >& )
+ {
+-    AddShape("com.sun.star.drawing.FrameShape");
++    uno::Reference<drawing::XShape> xShape(SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape());
++
++    uno::Reference< beans::XPropertySet > xProps(xShape, uno::UNO_QUERY);
++    // set FrameURL before AddShape, we have to do it again later because it
++    // gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
++    // FrameURL to exist when AddShape triggers SetPersistName which itself
++    // triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
++    // know what URL will end up being used. So bodge this by setting FrameURL
++    // to the temp pre-SdrOle2Obj attached properties and we can smuggle it
++    // eventually into SdrOle2Obj::SetPersistName at the right point after
++    // PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
++    // in order to inform the link manager that this is an IFrame that links to
++    // a URL
++    if (xProps && !maHref.isEmpty())
++        xProps->setPropertyValue("FrameURL", Any(maHref));
++
++    AddShape(xShape);
+ 
+     if( !mxShape.is() )
+         return;
+@@ -3222,7 +3248,6 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+     // set pos, size, shear and rotate
+     SetTransformation();
+ 
+-    uno::Reference< beans::XPropertySet > xProps( mxShape, uno::UNO_QUERY );
+     if( xProps.is() )
+     {
+         if( !maFrameName.isEmpty() )
+diff --git a/xmloff/source/draw/ximpshap.hxx b/xmloff/source/draw/ximpshap.hxx
+index 8a29b037229a..3931b3cdbb72 100644
+--- a/xmloff/source/draw/ximpshap.hxx
++++ b/xmloff/source/draw/ximpshap.hxx
+@@ -495,6 +495,8 @@ private:
+     OUString maFrameName;
+     OUString maHref;
+ 
++    css::uno::Reference<css::drawing::XShape> CreateFloatingFrameShape() const;
++
+ public:
+ 
+     SdXMLFloatingFrameShapeContext( SvXMLImport& rImport,
+-- 
+2.41.0
+
diff --git a/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch b/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
new file mode 100644
index 0000000..c5d7a57
--- /dev/null
+++ b/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
@@ -0,0 +1,50 @@
+From 0caab4f6da81346e54a2d4881ad52752071347ba Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Mon, 27 Feb 2023 16:10:06 +0100
+Subject: [PATCH 3/3] Always push a result, even if it's only an error
+
+PERCENTILE() and QUARTILE() if an error was passed as argument (or
+an error encountered during obtaining arguments) omitted to push
+an error result, only setting the error.
+
+Fallout from
+
+    commit f336f63da900d76c2bf6e5690f1c8a7bd15a0aa2
+    CommitDate: Thu Mar 3 16:28:59 2016 +0000
+
+        tdf#94635 Add FORECAST.ETS functions to Calc
+
+Change-Id: I23e276fb0ce735cfd6383cc963446499dcf819f4
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147922
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 64914560e279c71ff1233f4bab851e2a292797e6)
+---
+ sc/source/core/tool/interpr3.cxx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/tool/interpr3.cxx b/sc/source/core/tool/interpr3.cxx
+index 29c72f6f7280..cdbb4823a0e1 100644
+--- a/sc/source/core/tool/interpr3.cxx
++++ b/sc/source/core/tool/interpr3.cxx
+@@ -3481,7 +3481,7 @@ void ScInterpreter::ScPercentile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
++        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+@@ -3504,7 +3504,7 @@ void ScInterpreter::ScQuartile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
++        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+-- 
+2.41.0
+
diff --git a/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch b/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
new file mode 100644
index 0000000..9925004
--- /dev/null
+++ b/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
@@ -0,0 +1,53 @@
+From 71c3a616c4ebd9705827382d3cddc6b93c1dbdfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 20 Apr 2023 20:58:21 +0100
+Subject: [PATCH 3/3] assume IFrame script/macro support isn't needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+seems undocumented at least
+
+Change-Id: I316e4f4f25ddb7cf6b7bac4d856a721b987207a3
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151020
+Tested-by: Jenkins
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152154
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 797d92b5d1c33e8ca22450768533e9d5dc05f82f)
+---
+ sfx2/source/doc/iframe.cxx | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 73030f151359..e73fb1f1f2d1 100644
+--- a/sfx2/source/doc/iframe.cxx
++++ b/sfx2/source/doc/iframe.cxx
+@@ -166,20 +166,16 @@ sal_Bool SAL_CALL IFrameObject::load(
+         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+         xTrans->parseStrict( aTargetURL );
+ 
++        INetURLObject aURLObject(aTargetURL.Complete);
++        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
++            return false;
++
+         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+ 
+-        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+-        {
+-            if (pDoc && !pDoc->AdjustMacroMode())
+-                return false;
+-        }
+-
+         bool bUpdateAllowed(true);
+         if (pDoc)
+         {
+-            // perhaps should only check for file targets, but lets default to making it strong
+-            // unless there is a known need to distinguish
+             comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
+             bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
+         }
+-- 
+2.41.0
+
diff --git a/SOURCES/0005-CVE-2022-3140-Filter-out-unwanted-command-URIs.patch b/SOURCES/0005-CVE-2022-3140-Filter-out-unwanted-command-URIs.patch
new file mode 100644
index 0000000..a1db0e4
--- /dev/null
+++ b/SOURCES/0005-CVE-2022-3140-Filter-out-unwanted-command-URIs.patch
@@ -0,0 +1,292 @@
+From 86c29694ddf10b51ecd76b4f1397d798f62cc709 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Tue, 30 Aug 2022 14:04:52 +0200
+Subject: [PATCH 5/5] CVE-2022-3140 Filter out unwanted command URIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139225
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 27d29f7df428885865a8e2313283839b20f2a34b)
+Conflicts:
+	desktop/source/app/cmdlineargs.cxx
+
+Change-Id: I0b7e5329af8cc053d14d5c60ec14fe7f364ef993
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139182
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit da291e2960b75153f41d440a1b41961567432e8c)
+
+These commands are always URLs already
+
+Change-Id: I5083765c879689d7f933bbe00ad70bb68e635a21
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139042
+Tested-by: Jean-Pierre Ledure <jp@ledure.be>
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit e61701e1ee6763de72b397e6ade1124eca9400f3)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138980
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 5b4025bb56999f5c895c6f7e0b52f521800d65b0)
+
+check IFrame "FrameURL" target
+
+similiar to
+
+commit b3edf85e0fe6ca03dc26e1bf531be82193bc9627
+Date:   Wed Aug 7 17:37:11 2019 +0100
+
+    warn on load when a document binds an event to a macro
+
+Change-Id: Iea888b1c083d2dc69ec322309ac9ae8c5e5eb315
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139059
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit c7450d0b9d02c64ae3da467d329040787039767e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139117
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+(cherry picked from commit f5e3b0a7966d7d28817292adbb58fb43f28b7c6d)
+
+check impress/calc IFrame "FrameURL" target
+
+similar to
+
+commit c7450d0b9d02c64ae3da467d329040787039767e
+Date:   Tue Aug 30 17:01:08 2022 +0100
+
+    check IFrame "FrameURL" target
+
+Change-Id: Ibf28c29acb4476830431d02772f3ecd4b23a6a27
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139495
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit d0312786571221c2dd4f63fa69f6f0489d7d39ec)
+---
+ desktop/source/app/cmdlineargs.cxx        | 10 +++++++++-
+ sfx2/source/appl/macroloader.cxx          |  9 +++++++--
+ sfx2/source/doc/iframe.cxx                | 21 ++++++++++++++++-----
+ sfx2/source/inc/macroloader.hxx           |  2 ++
+ sw/source/filter/html/htmlplug.cxx        |  7 ++++++-
+ sw/source/filter/xml/xmltexti.cxx         |  9 +++++++--
+ wizards/source/access2base/DoCmd.xba      |  2 +-
+ wizards/source/scriptforge/SF_Session.xba |  2 +-
+ xmloff/source/draw/ximpshap.cxx           |  4 ++++
+ 9 files changed, 53 insertions(+), 13 deletions(-)
+
+diff --git a/desktop/source/app/cmdlineargs.cxx b/desktop/source/app/cmdlineargs.cxx
+index 4d5a3bb78396..93d9e8742ba8 100644
+--- a/desktop/source/app/cmdlineargs.cxx
++++ b/desktop/source/app/cmdlineargs.cxx
+@@ -28,6 +28,7 @@
+ #include "cmdlineargs.hxx"
+ #include <osl/thread.hxx>
+ #include <tools/stream.hxx>
++#include <tools/urlobj.hxx>
+ #include <rtl/ustring.hxx>
+ #include <rtl/process.h>
+ #include <comphelper/lok.hxx>
+@@ -166,7 +167,14 @@ CommandLineEvent CheckOfficeURI(/* in,out */ OUString& arg, CommandLineEvent cur
+     }
+     if (nURIlen < 0)
+         nURIlen = rest2.getLength();
+-    arg = rest2.copy(0, nURIlen);
++    auto const uri = rest2.copy(0, nURIlen);
++    if (INetURLObject(uri).GetProtocol() == INetProtocol::Macro) {
++        // Let the "Open" machinery process the full command URI (leading to failure, by intention,
++        // as the "Open" machinery does not know about those command URI schemes):
++        curEvt = CommandLineEvent::Open;
++    } else {
++        arg = uri;
++    }
+     return curEvt;
+ }
+ 
+diff --git a/sfx2/source/appl/macroloader.cxx b/sfx2/source/appl/macroloader.cxx
+index 46090f712665..ad70ef5fa0f6 100644
+--- a/sfx2/source/appl/macroloader.cxx
++++ b/sfx2/source/appl/macroloader.cxx
+@@ -68,10 +68,10 @@ css::uno::Sequence<OUString> SAL_CALL SfxMacroLoader::getSupportedServiceNames()
+     return { "com.sun.star.frame.ProtocolHandler" };
+ }
+ 
+-SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
++SfxObjectShell* SfxMacroLoader::GetObjectShell(const Reference <XFrame>& xFrame)
+ {
+     SfxObjectShell* pDocShell = nullptr;
+-    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
++
+     if ( xFrame.is() )
+     {
+         SfxFrame* pFrame=nullptr;
+@@ -88,6 +88,11 @@ SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+     return pDocShell;
+ }
+ 
++SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
++{
++    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
++    return SfxMacroLoader::GetObjectShell(xFrame);
++}
+ 
+ uno::Reference<frame::XDispatch> SAL_CALL SfxMacroLoader::queryDispatch(
+     const util::URL&   aURL            ,
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index e37607c91a46..3f9036a79b04 100644
+--- a/sfx2/source/doc/iframe.cxx
++++ b/sfx2/source/doc/iframe.cxx
+@@ -38,10 +38,12 @@
+ #include <officecfg/Office/Common.hxx>
+ #include <svl/itemprop.hxx>
+ #include <sfx2/frmdescr.hxx>
++#include <sfx2/objsh.hxx>
+ #include <sfx2/sfxdlg.hxx>
+ #include <toolkit/helper/vclunohelper.hxx>
+ #include <vcl/window.hxx>
+ #include <tools/debug.hxx>
++#include <macroloader.hxx>
+ 
+ using namespace ::com::sun::star;
+ 
+@@ -157,6 +159,19 @@ sal_Bool SAL_CALL IFrameObject::load(
+ {
+     if ( officecfg::Office::Common::Misc::PluginsEnabled::get() )
+     {
++        util::URL aTargetURL;
++        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
++        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
++        xTrans->parseStrict( aTargetURL );
++
++        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
++        {
++            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
++            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
++            if (pDoc && !pDoc->AdjustMacroMode())
++                return false;
++        }
++
+         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+@@ -179,16 +194,12 @@ sal_Bool SAL_CALL IFrameObject::load(
+         if ( xFramesSupplier.is() )
+             mxFrame->setCreator( xFramesSupplier );
+ 
+-        util::URL aTargetURL;
+-        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+-        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+-        xTrans->parseStrict( aTargetURL );
+-
+         uno::Sequence < beans::PropertyValue > aProps(2);
+         aProps[0].Name = "PluginMode";
+         aProps[0].Value <<= sal_Int16(2);
+         aProps[1].Name = "ReadOnly";
+         aProps[1].Value <<= true;
++
+         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
+         if ( xDisp.is() )
+             xDisp->dispatch( aTargetURL, aProps );
+diff --git a/sfx2/source/inc/macroloader.hxx b/sfx2/source/inc/macroloader.hxx
+index 051486c09adf..62a6555ff877 100644
+--- a/sfx2/source/inc/macroloader.hxx
++++ b/sfx2/source/inc/macroloader.hxx
+@@ -79,6 +79,8 @@ public:
+     virtual void SAL_CALL addStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
+ 
+     virtual void SAL_CALL removeStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
++
++    static SfxObjectShell* GetObjectShell(const css::uno::Reference<css::frame::XFrame>& xFrame);
+ };
+ 
+ #endif
+diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
+index 65e0419f4ed9..90036cfac67a 100644
+--- a/sw/source/filter/html/htmlplug.cxx
++++ b/sw/source/filter/html/htmlplug.cxx
+@@ -1090,7 +1090,12 @@ void SwHTMLParser::InsertFloatingFrame()
+                 bool bHasBorder = aFrameDesc.HasFrameBorder();
+                 Size aMargin = aFrameDesc.GetMargin();
+ 
+-                xSet->setPropertyValue("FrameURL", uno::makeAny( aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE ) ) );
++                OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
++
++                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
++                    NotifyMacroEventRead();
++
++                xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
+                 xSet->setPropertyValue("FrameName", uno::makeAny( aName ) );
+ 
+                 if ( eScroll == ScrollingMode::Auto )
+diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
+index cf0c7e6a85ba..eaf45dd91cd4 100644
+--- a/sw/source/filter/xml/xmltexti.cxx
++++ b/sw/source/filter/xml/xmltexti.cxx
+@@ -857,9 +857,14 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
+             uno::Reference < beans::XPropertySet > xSet( xObj->getComponent(), uno::UNO_QUERY );
+             if ( xSet.is() )
+             {
++                OUString sHRef = URIHelper::SmartRel2Abs(
++                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
++
++                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
++                    GetXMLImport().NotifyMacroEventRead();
++
+                 xSet->setPropertyValue("FrameURL",
+-                    makeAny( URIHelper::SmartRel2Abs(
+-                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef ) ) );
++                    makeAny( rHRef ) );
+ 
+                 xSet->setPropertyValue("FrameName",
+                     makeAny( rName ) );
+diff --git a/wizards/source/access2base/DoCmd.xba b/wizards/source/access2base/DoCmd.xba
+index 089486a872fa..20051553c47f 100644
+--- a/wizards/source/access2base/DoCmd.xba
++++ b/wizards/source/access2base/DoCmd.xba
+@@ -2655,7 +2655,7 @@ Private Sub _ShellExecute(sCommand As String)
+ 
+ Dim oShell As Object
+ 	Set oShell = createUnoService(&quot;com.sun.star.system.SystemShellExecute&quot;)
+-	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
++	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
+ 
+ End Sub				&apos;	_ShellExecute			V0.8.5
+ 
+diff --git a/wizards/source/scriptforge/SF_Session.xba b/wizards/source/scriptforge/SF_Session.xba
+index a41bffa51377..7c709897947a 100644
+--- a/wizards/source/scriptforge/SF_Session.xba
++++ b/wizards/source/scriptforge/SF_Session.xba
+@@ -513,7 +513,7 @@ Check:
+ Try:
+ 	Set oShell = SF_Utils._GetUNOService(&quot;SystemShellExecute&quot;)
+ 	sCommand = SF_FileSystem._ConvertToUrl(Command)
+-	oShell.execute(sCommand, Parameters, com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
++	oShell.execute(sCommand, Parameters, com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
+ 	bReturn = True
+ 
+ Finally:
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index 65a7e2fb0eef..4afa4e039776 100644
+--- a/xmloff/source/draw/ximpshap.cxx
++++ b/xmloff/source/draw/ximpshap.cxx
+@@ -87,6 +87,7 @@
+ #include <basegfx/polygon/b2dpolypolygon.hxx>
+ #include <basegfx/polygon/b2dpolypolygontools.hxx>
+ #include <basegfx/vector/b2dvector.hxx>
++#include <tools/urlobj.hxx>
+ #include <o3tl/any.hxx>
+ #include <o3tl/safeint.hxx>
+ 
+@@ -3231,6 +3232,9 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+ 
+         if( !maHref.isEmpty() )
+         {
++            if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
++                GetImport().NotifyMacroEventRead();
++
+             xProps->setPropertyValue("FrameURL", Any(maHref) );
+         }
+     }
+-- 
+2.37.3
+
diff --git a/SPECS/libreoffice.spec b/SPECS/libreoffice.spec
index c35834b..f4312c9 100644
--- a/SPECS/libreoffice.spec
+++ b/SPECS/libreoffice.spec
@@ -8,7 +8,7 @@
 %global libo_buildfix %{nil}
 # rhbz#715152 state vendor
 %if 0%{?rhel}
-%global vendoroption --with-vendor="Red Hat, Inc."
+%global vendoroption --with-vendor="AlmaLinux OS Foundation"
 %endif
 %if 0%{?fedora}
 %global vendoroption --with-vendor="The Fedora Project"
@@ -27,6 +27,7 @@
 # URL for external projects' tarballs
 %global external_url http://dev-www.libreoffice.org/src
 %global girapiversion 0.1
+%global dist %{?dist}.alma
 
 # get english only and no-langpacks for a faster smoketest build
 # fedpkg compile/install/local/mockbuild does not handle --without ATM,
@@ -57,7 +58,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.1
-Release:        8%{?libo_prerelease}%{?dist}
+Release:        11%{?libo_prerelease}%{?dist}
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/
 
@@ -278,6 +279,17 @@ Patch22: 0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
 Patch23: 0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
 Patch24: 0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
 Patch25: 0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
+Patch26: 0005-CVE-2022-3140-Filter-out-unwanted-command-URIs.patch
+Patch27: 0001-CVE-2022-38745.patch
+Patch28: 0001-Don-t-use-Library_tl-in-URE-libraries.patch
+Patch29: 0001-URE-Library_boostrap-should-not-depend-on-Library_co.patch
+Patch30: 0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
+Patch31: 0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
+Patch32: 0003-Always-push-a-result-even-if-it-s-only-an-error.patch
+Patch33: 0001-set-Referer-on-loading-IFrames.patch
+Patch34: 0002-put-floating-frames-under-managed-links-control.patch
+Patch35: 0003-assume-IFrame-script-macro-support-isn-t-needed.patch
+Patch36: 0001-disable-script-dump.patch
 
 # not upstreamed
 Patch500: 0001-disable-libe-book-support.patch
@@ -1017,17 +1029,6 @@ rm -rf git-hooks */git-hooks
 %global __scm git_am
 %__scm_setup_git_am
 
-#Customize Palette to add Red Hat colours
-(head -n -1 extras/source/palettes/standard.soc && \
- echo -e '  <draw:color draw:name="Red Hat 1" draw:color="#cc0000"/>
-  <draw:color draw:name="Red Hat 2" draw:color="#0093d9"/>
-  <draw:color draw:name="Red Hat 3" draw:color="#ff8d00"/>
-  <draw:color draw:name="Red Hat 4" draw:color="#abb400"/>
-  <draw:color draw:name="Red Hat 5" draw:color="#4e376b"/>' && \
- tail -n 1 extras/source/palettes/standard.soc) > redhat.soc
-mv -f redhat.soc extras/source/palettes/standard.soc
-git commit -q -a -m 'add Red Hat colors to palette'
-
 # apply patches
 %autopatch -M 99
 %if 0%{?rhel}
@@ -2274,15 +2275,28 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || :
 %{_includedir}/LibreOfficeKit
 
 %changelog
+* Thu Sep 21 2023 Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-11.alma
+- Debrand for AlmaLinux
+
+* Tue Jun 20 2023 Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
+- Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
+  Parsing
+- Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
+  without prompt via IFrame
+- Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write
+* Tue May 16 2023 Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-10
+- Fix erroneous libreoffice-ure dependencies
+
+* Wed Apr 12 2023 Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-9
+- Resolves: rhbz#2182392 CVE-2022-38745
+
 * Thu Oct 20 2022 Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
 - Resolves: rhbz#2134759 Untrusted Macros
 - Resolves: rhbz#2134757 Weak Master Keys
 - Resolves: rhbz#2134755 Static Initialization Vector
 - Resolves: rhbz#2134761 Macro URL arbitrary script execution
-
 * Tue May 10 2022 Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-7
 - Resolves: rhbz#2081661 fix gtk_tree_view_scroll_to_cell assert
-
 * Tue Feb 22 2022 Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-6
 - Resolves: rhbz#2056412 merge in fedoa 34 changes