102 changed files with 25806 additions and 7599 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,14 +1,7 @@
 SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip
 SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
 SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
-SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+SOURCES/libreoffice-6.4.7.2.tar.xz
-SOURCES/libreoffice-6.0.6.1.tar.xz
+SOURCES/libreoffice-help-6.4.7.2.tar.xz
-SOURCES/libreoffice-base-symbolic.svg
+SOURCES/libreoffice-translations-6.4.7.2.tar.xz
 SOURCES/libreoffice-calc-symbolic.svg
 SOURCES/libreoffice-draw-symbolic.svg
 SOURCES/libreoffice-help-6.0.6.1.tar.xz
 SOURCES/libreoffice-impress-symbolic.svg
 SOURCES/libreoffice-main-symbolic.svg
 SOURCES/libreoffice-math-symbolic.svg
 SOURCES/libreoffice-translations-6.0.6.1.tar.xz
 SOURCES/libreoffice-writer-symbolic.svg
--- a/.libreoffice.metadata
+++ b/.libreoffice.metadata
@ -1,14 +1,7 @@
 7168b0f40aa5c72267899601c116d2348d2f56ec SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip
 0619ed3a89644bef318df67db12045b2b590585b SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
 d336802a36ed2c87dd243e7c2f1d0542dace5cca SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
 2d49e11b0b711970f494294dc3698f05eb294853 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
-7b5fd93d787fbc6d9c2d4025d543730ee8dc4559 SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+b29d8cdb3db8d6b317e1cb9117b020d7e676e601 SOURCES/libreoffice-6.4.7.2.tar.xz
-7a10bc2e3d39a2b61a507eae30c8b505dcd4f553 SOURCES/libreoffice-6.0.6.1.tar.xz
+ca7e087ef62f30c033db84ceb0f6a4021f53653e SOURCES/libreoffice-help-6.4.7.2.tar.xz
-54fc749ba924f9ca4e0391caaf579ab344302038 SOURCES/libreoffice-base-symbolic.svg
+0f74fd6286e71ff2b7c7bc01f41c8972e354d81c SOURCES/libreoffice-translations-6.4.7.2.tar.xz
 9de544172d736d59589767000c1f657034a5d53d SOURCES/libreoffice-calc-symbolic.svg
 0f6dc4726da0920869354fbe4b2924f9ac569b4a SOURCES/libreoffice-draw-symbolic.svg
 d453fdf82bf65f79bfbf70986720436ba4d9ed51 SOURCES/libreoffice-help-6.0.6.1.tar.xz
 8c74dd667c660cc643c4d715dd50491ba92146d5 SOURCES/libreoffice-impress-symbolic.svg
 c77acd04a7647b09745f9424ab0f65d52dfcd397 SOURCES/libreoffice-main-symbolic.svg
 3857a55644148eb25ed1a594bd00d1262761fb39 SOURCES/libreoffice-math-symbolic.svg
 9dbf1c8f3b373a3ec15e989f86c1a34a7d7aa761 SOURCES/libreoffice-translations-6.0.6.1.tar.xz
 d4f0674ad46a832120db956cc01a27fdc2060458 SOURCES/libreoffice-writer-symbolic.svg
--- a/SOURCES/0001-0.5.1-is-sufficient.patch
+++ b/SOURCES/0001-0.5.1-is-sufficient.patch
@ -0,0 +1,46 @@
 From ceac69bff953ebd9b54a1f3a032079523c4414d0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Sun, 25 Oct 2020 20:23:39 +0000
 Subject: [PATCH] 0.5.1 is sufficient
 Change-Id: I710a83de8f261d6164eb760d3290c963a5bbe5e1
 ---
 configure.ac | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)
 diff --git a/configure.ac b/configure.ac
 index a6696df15f06..c17fdf5b0d22 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -7050,7 +7050,7 @@ dnl Check for system libcmis
 dnl ===================================================================
 # libcmis requires curl and we can't build curl for iOS
 if test $_os != iOS; then
 -    libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.5 >= 0.5.2])
 +    libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.5 >= 0.5.0])
     ENABLE_LIBCMIS=TRUE
 else
     ENABLE_LIBCMIS=
@@ -7090,19 +7090,6 @@ elif test "$GCC" = "yes" -o "$COM_IS_CLANG" = TRUE; then
             #include <functional>
             #include <vector>
 -            #if defined SYSTEM_LIBCMIS
 -            // See ucb/source/ucp/cmis/auth_provider.hxx:
 -            #if !defined __clang__
 -            #pragma GCC diagnostic push
 -            #pragma GCC diagnostic ignored "-Wdeprecated"
 -            #pragma GCC diagnostic ignored "-Wunused-but-set-parameter"
 -            #endif
 -            #include <libcmis/libcmis.hxx>
 -            #if !defined __clang__
 -            #pragma GCC diagnostic pop
 -            #endif
 -            #endif
 -
             void f(std::vector<int> & v, std::function<bool(int, int)> fn) {
                 std::sort(v.begin(), v.end(), fn);
             }
 -- 
 2.26.2
--- a/SOURCES/0001-1.2.25-is-sufficient.patch
+++ b/SOURCES/0001-1.2.25-is-sufficient.patch
@ -0,0 +1,26 @@
 From 92c95c8c3724f267e57827f69f93ef4e6387f793 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Sun, 25 Oct 2020 21:14:10 +0000
 Subject: [PATCH] 1.2.25 is sufficient
 Change-Id: Ie184fbaaf6eea0ae1a39bf142d3391768be9607d
 ---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/configure.ac b/configure.ac
 index a62c131a6d0e..c815ea2c3f8b 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -8364,7 +8364,7 @@ libo_CHECK_SYSTEM_MODULE([expat], [EXPAT], [expat])
 dnl ===================================================================
 dnl Check for system xmlsec
 dnl ===================================================================
 -libo_CHECK_SYSTEM_MODULE([xmlsec], [XMLSEC], [xmlsec1-nss >= 1.2.28])
 +libo_CHECK_SYSTEM_MODULE([xmlsec], [XMLSEC], [xmlsec1-nss >= 1.2.25])
 AC_MSG_CHECKING([whether to enable Embedded OpenType support])
 if test "$_os" != "WINNT" -a "$_os" != "Darwin" -a "$enable_eot" = "yes"; then
 -- 
 2.26.2
--- a/SOURCES/0001-Adapt-to-Python-3.patch
+++ b/SOURCES/0001-Adapt-to-Python-3.patch
@ -1,23 +0,0 @@
 From 6deba9b85bc9d5eb4f297ea305bcddfbad0060e1 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Tue, 3 Jul 2018 09:30:37 +0200
 Subject: [PATCH] Adapt to Python 3
 Change-Id: I7c44c23810a79242ec5ddf52a316b4bba7d838ce
 ---
 solenv/bin/pack_images.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/solenv/bin/pack_images.py b/solenv/bin/pack_images.py
 index 0f493c8f3035..b66ea34e731c 100755
 --- a/solenv/bin/pack_images.py
 +++ b/solenv/bin/pack_images.py
@@ -1,4 +1,4 @@
 -#!/usr/bin/env python
 +#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 # -*- tab-width: 4; indent-tabs-mode: nil; py-indent-offset: 4 -*-
 #
 -- 
 2.17.1
--- a/SOURCES/0001-CVE-2021-25636.patch
+++ b/SOURCES/0001-CVE-2021-25636.patch
@ -0,0 +1,69 @@
 From ae1bd20a2d4d7b7d64edc3b06d7f901c05175b7d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 20 Dec 2021 17:05:44 +0000
 Subject: [PATCH] only use X509Data
 Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
 Tested-by: Jenkins
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178
 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
 (cherry picked from commit b0404f80577de9ff69e58390c6f6ef949fdb0139)
 ---
 .../source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx      | 6 ++++++
 xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx      | 6 ++++++
 2 files changed, 12 insertions(+)
 diff --git a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
 index db400e6..39f9d7f 100644
 --- a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
 +++ b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
@@ -21,6 +21,8 @@
 #include <sal/log.hxx>
 #include <rtl/uuid.h>
 +#include <xmlsec/mscng/x509.h>
 +
 #include <com/sun/star/xml/crypto/SecurityOperationStatus.hpp>
 #include <com/sun/star/xml/crypto/XXMLSignature.hpp>
@@ -229,6 +231,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
     // We do certificate verification ourselves.
     pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
 +    // limit possible key data to valid X509 certificates only, no KeyValues
 +    if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
 +        throw RuntimeException("failed to limit allowed key data");
 +
     //Verify signature
     //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
     //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if
 diff --git a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
 index 827580b..8f4d6f8 100644
 --- a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
 +++ b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
@@ -19,6 +19,8 @@
 #include <sal/config.h>
 +#include <xmlsec/nss/x509.h>
 +
 #include <xmlelementwrapper_xmlsecimpl.hxx>
 #include <xmlsec/xmlstreamio.hxx>
 #include <xmlsec/errorcallback.hxx>
@@ -243,6 +245,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
         // We do certificate verification ourselves.
         pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
 +        // limit possible key data to valid X509 certificates only, no KeyValues
 +        if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
 +            throw RuntimeException("failed to limit allowed key data");
 +
         //Verify signature
         int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );
 -- 
 2.33.1
--- a/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
+++ b/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
@ -0,0 +1,63 @@
 From 77f30ada1156ca1e1357776fea8e9dc113f6898d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 3 Mar 2022 14:22:37 +0000
 Subject: [PATCH 1/4] CVE-2022-26305 compare authors using Thumbprint
 Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929
 Tested-by: Jenkins
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8)
 ---
 .../component/documentdigitalsignatures.cxx   | 23 +++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)
 diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
 index b9066ea92cac..5a21c8421bec 100644
 --- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
 +++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
@@ -19,9 +19,10 @@
 #include <resourcemanager.hxx>
 -#include <digitalsignaturesdialog.hxx>
 +#include <certificate.hxx>
 #include <certificatechooser.hxx>
 #include <certificateviewer.hxx>
 +#include <digitalsignaturesdialog.hxx>
 #include <macrosecurity.hxx>
 #include <biginteger.hxx>
 #include <strings.hrc>
@@ -666,9 +667,23 @@ sal_Bool DocumentDigitalSignatures::isAuthorTrusted(
     Sequence< SvtSecurityOptions::Certificate > aTrustedAuthors = SvtSecurityOptions().GetTrustedAuthors();
     return std::any_of(aTrustedAuthors.begin(), aTrustedAuthors.end(),
 -        [&xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
 -            return xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName())
 -                && ( rAuthor[1] == sSerialNum );
 +        [this, &xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
 +            if (!xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName()))
 +                return false;
 +            if (rAuthor[1] != sSerialNum)
 +                return false;
 +
 +            DocumentSignatureManager aSignatureManager(mxCtx, {});
 +            if (!aSignatureManager.init())
 +                return false;
 +            uno::Reference<css::security::XCertificate> xCert = aSignatureManager.getSecurityEnvironment()->createCertificateFromAscii(rAuthor[2]);
 +
 +            auto pAuthor = dynamic_cast<xmlsecurity::Certificate*>(xAuthor.get());
 +            auto pCert = dynamic_cast<xmlsecurity::Certificate*>(xCert.get());
 +            if (pAuthor && pCert)
 +                return pCert->getSHA256Thumbprint() == pAuthor->getSHA256Thumbprint();
 +
 +            return xCert->getSHA1Thumbprint() == xAuthor->getSHA1Thumbprint();
         });
 }
 -- 
 2.37.1
--- a/SOURCES/0001-CVE-2022-3140.patch
+++ b/SOURCES/0001-CVE-2022-3140.patch
@ -0,0 +1,279 @@
 From 3831e68bffc233f581e3eb1cb3c7ed925daab86f Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Tue, 30 Aug 2022 14:04:52 +0200
 Subject: [PATCH] Filter out unwanted command URIs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139225
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 27d29f7df428885865a8e2313283839b20f2a34b)
 Conflicts:
 	desktop/source/app/cmdlineargs.cxx
 Change-Id: I0b7e5329af8cc053d14d5c60ec14fe7f364ef993
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139182
 Tested-by: Jenkins
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit da291e2960b75153f41d440a1b41961567432e8c)
 These commands are always URLs already
 Change-Id: I5083765c879689d7f933bbe00ad70bb68e635a21
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139042
 Tested-by: Jean-Pierre Ledure <jp@ledure.be>
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit e61701e1ee6763de72b397e6ade1124eca9400f3)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138980
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 5b4025bb56999f5c895c6f7e0b52f521800d65b0)
 check IFrame "FrameURL" target
 similiar to
 commit b3edf85e0fe6ca03dc26e1bf531be82193bc9627
 Date:   Wed Aug 7 17:37:11 2019 +0100
    warn on load when a document binds an event to a macro
 Change-Id: Iea888b1c083d2dc69ec322309ac9ae8c5e5eb315
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139059
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit c7450d0b9d02c64ae3da467d329040787039767e)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139117
 Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
 (cherry picked from commit f5e3b0a7966d7d28817292adbb58fb43f28b7c6d)
 check impress/calc IFrame "FrameURL" target
 similar to
 commit c7450d0b9d02c64ae3da467d329040787039767e
 Date:   Tue Aug 30 17:01:08 2022 +0100
    check IFrame "FrameURL" target
 Change-Id: Ibf28c29acb4476830431d02772f3ecd4b23a6a27
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139495
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit d0312786571221c2dd4f63fa69f6f0489d7d39ec)
 ---
 desktop/source/app/cmdlineargs.cxx   | 10 +++++++++-
 sfx2/source/appl/macroloader.cxx     |  9 +++++++--
 sfx2/source/doc/iframe.cxx           | 21 ++++++++++++++++-----
 sfx2/source/inc/macroloader.hxx      |  2 ++
 sw/source/filter/html/htmlplug.cxx   |  7 ++++++-
 sw/source/filter/xml/xmltexti.cxx    |  9 +++++++--
 wizards/source/access2base/DoCmd.xba |  2 +-
 xmloff/source/draw/ximpshap.cxx      |  4 ++++
 8 files changed, 52 insertions(+), 12 deletions(-)
 diff --git a/desktop/source/app/cmdlineargs.cxx b/desktop/source/app/cmdlineargs.cxx
 index 381147c..5babfbe 100644
 --- a/desktop/source/app/cmdlineargs.cxx
 +++ b/desktop/source/app/cmdlineargs.cxx
@@ -27,6 +27,7 @@
 #include "cmdlineargs.hxx"
 #include <tools/stream.hxx>
 +#include <tools/urlobj.hxx>
 #include <vcl/svapp.hxx>
 #include <rtl/uri.hxx>
 #include <rtl/ustring.hxx>
@@ -169,7 +170,14 @@ CommandLineEvent CheckOfficeURI(/* in,out */ OUString& arg, CommandLineEvent cur
     }
     if (nURIlen < 0)
         nURIlen = rest2.getLength();
 -    arg = rest2.copy(0, nURIlen);
 +    auto const uri = rest2.copy(0, nURIlen);
 +    if (INetURLObject(uri).GetProtocol() == INetProtocol::Macro) {
 +        // Let the "Open" machinery process the full command URI (leading to failure, by intention,
 +        // as the "Open" machinery does not know about those command URI schemes):
 +        curEvt = CommandLineEvent::Open;
 +    } else {
 +        arg = uri;
 +    }
     return curEvt;
 }
 diff --git a/sfx2/source/appl/macroloader.cxx b/sfx2/source/appl/macroloader.cxx
 index 98e036e..b50d1e6 100644
 --- a/sfx2/source/appl/macroloader.cxx
 +++ b/sfx2/source/appl/macroloader.cxx
@@ -76,10 +76,10 @@ css::uno::Sequence<OUString> SAL_CALL SfxMacroLoader::getSupportedServiceNames()
     return aSeq;
 }
 -SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
 +SfxObjectShell* SfxMacroLoader::GetObjectShell(const Reference <XFrame>& xFrame)
 {
     SfxObjectShell* pDocShell = nullptr;
 -    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
 +
     if ( xFrame.is() )
     {
         SfxFrame* pFrame=nullptr;
@@ -96,6 +96,11 @@ SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
     return pDocShell;
 }
 +SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
 +{
 +    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
 +    return SfxMacroLoader::GetObjectShell(xFrame);
 +}
 uno::Reference<frame::XDispatch> SAL_CALL SfxMacroLoader::queryDispatch(
     const util::URL&   aURL            ,
 diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
 index 8b12715..b5291b2 100644
 --- a/sfx2/source/doc/iframe.cxx
 +++ b/sfx2/source/doc/iframe.cxx
@@ -39,11 +39,13 @@
 #include <svl/ownlist.hxx>
 #include <svl/itemprop.hxx>
 #include <sfx2/frmdescr.hxx>
 +#include <sfx2/objsh.hxx>
 #include <sfx2/sfxdlg.hxx>
 #include <sfx2/sfxsids.hrc>
 #include <toolkit/helper/vclunohelper.hxx>
 #include <vcl/window.hxx>
 #include <tools/debug.hxx>
 +#include <macroloader.hxx>
 using namespace ::com::sun::star;
@@ -159,6 +161,19 @@ sal_Bool SAL_CALL IFrameObject::load(
 {
     if ( SvtMiscOptions().IsPluginsEnabled() )
     {
 +        util::URL aTargetURL;
 +        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
 +        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
 +        xTrans->parseStrict( aTargetURL );
 +
 +        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
 +        {
 +            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
 +            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
 +            if (pDoc && !pDoc->AdjustMacroMode())
 +                return false;
 +        }
 +
         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
@@ -181,16 +196,12 @@ sal_Bool SAL_CALL IFrameObject::load(
         if ( xFramesSupplier.is() )
             mxFrame->setCreator( xFramesSupplier );
 -        util::URL aTargetURL;
 -        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
 -        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
 -        xTrans->parseStrict( aTargetURL );
 -
         uno::Sequence < beans::PropertyValue > aProps(2);
         aProps[0].Name = "PluginMode";
         aProps[0].Value <<= sal_Int16(2);
         aProps[1].Name = "ReadOnly";
         aProps[1].Value <<= true;
 +
         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
         if ( xDisp.is() )
             xDisp->dispatch( aTargetURL, aProps );
 diff --git a/sfx2/source/inc/macroloader.hxx b/sfx2/source/inc/macroloader.hxx
 index 9e1dfba..b3e7a5e 100644
 --- a/sfx2/source/inc/macroloader.hxx
 +++ b/sfx2/source/inc/macroloader.hxx
@@ -82,6 +82,8 @@ public:
     virtual void SAL_CALL addStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
     virtual void SAL_CALL removeStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
 +
 +    static SfxObjectShell* GetObjectShell(const css::uno::Reference<css::frame::XFrame>& xFrame);
 };
 #endif
 diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
 index a0da671..eb70704 100644
 --- a/sw/source/filter/html/htmlplug.cxx
 +++ b/sw/source/filter/html/htmlplug.cxx
@@ -1087,7 +1087,12 @@ void SwHTMLParser::InsertFloatingFrame()
                 bool bHasBorder = aFrameDesc.HasFrameBorder();
                 Size aMargin = aFrameDesc.GetMargin();
 -                xSet->setPropertyValue("FrameURL", uno::makeAny( aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE ) ) );
 +                OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
 +
 +                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
 +                    NotifyMacroEventRead();
 +
 +                xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
                 xSet->setPropertyValue("FrameName", uno::makeAny( aName ) );
                 if ( eScroll == ScrollingMode::Auto )
 diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
 index 788bec5..72a14b9 100644
 --- a/sw/source/filter/xml/xmltexti.cxx
 +++ b/sw/source/filter/xml/xmltexti.cxx
@@ -853,9 +853,14 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
             uno::Reference < beans::XPropertySet > xSet( xObj->getComponent(), uno::UNO_QUERY );
             if ( xSet.is() )
             {
 +                OUString sHRef = URIHelper::SmartRel2Abs(
 +                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
 +
 +                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
 +                    GetXMLImport().NotifyMacroEventRead();
 +
                 xSet->setPropertyValue("FrameURL",
 -                    makeAny( URIHelper::SmartRel2Abs(
 -                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef ) ) );
 +                    makeAny( rHRef ) );
                 xSet->setPropertyValue("FrameName",
                     makeAny( rName ) );
 diff --git a/wizards/source/access2base/DoCmd.xba b/wizards/source/access2base/DoCmd.xba
 index 27b0d74..26755a8 100644
 --- a/wizards/source/access2base/DoCmd.xba
 +++ b/wizards/source/access2base/DoCmd.xba
@@ -2655,7 +2655,7 @@ Private Sub _ShellExecute(sCommand As String)
 Dim oShell As Object
 	Set oShell = createUnoService(&quot;com.sun.star.system.SystemShellExecute&quot;)
 -	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
 +	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
 End Sub				&apos;	_ShellExecute			V0.8.5
 diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
 index 2e509f8..ae35f1e 100644
 --- a/xmloff/source/draw/ximpshap.cxx
 +++ b/xmloff/source/draw/ximpshap.cxx
@@ -87,6 +87,7 @@
 #include <basegfx/polygon/b2dpolypolygon.hxx>
 #include <basegfx/polygon/b2dpolypolygontools.hxx>
 #include <basegfx/vector/b2dvector.hxx>
 +#include <tools/urlobj.hxx>
 #include <o3tl/safeint.hxx>
 using namespace ::com::sun::star;
@@ -3243,6 +3244,9 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
             if( !maHref.isEmpty() )
             {
 +                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
 +                    GetImport().NotifyMacroEventRead();
 +
                 xProps->setPropertyValue("FrameURL", Any(maHref) );
             }
         }
 -- 
 2.37.3
--- a/SOURCES/0001-CVE-2022-38745.patch
+++ b/SOURCES/0001-CVE-2022-38745.patch
@ -0,0 +1,93 @@
 From 36c5c16b7846ff31f403913ad5cdddf8b22fda43 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Mon, 21 Feb 2022 11:55:21 +0100
 Subject: [PATCH] Avoid unnecessary empty -Djava.class.path=
 Change-Id: Idcfe7321077b60381c0273910b1faeb444ef1fd8
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130242
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 ---
 .../plugins/sunmajor/pluginlib/sunjavaplugin.cxx | 16 +++++++++++++---
 jvmfwk/source/framework.cxx                      |  8 ++++++--
 jvmfwk/source/fwkbase.cxx                        |  3 +++
 3 files changed, 22 insertions(+), 5 deletions(-)
 diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
 index 4760ab6..ea133ea 100644
 --- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
 +++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
@@ -687,17 +687,22 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
     // all versions below 1.5.1
     options.emplace_back("abort", reinterpret_cast<void*>(abort_handler));
     bool hasStackSize = false;
 +#ifdef UNX
 +    // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
 +    // in the class path in order to have applet support:
 +    OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
 +#endif
     for (int i = 0; i < cOptions; i++)
     {
         OString opt(arOptions[i].optionString);
 #ifdef UNX
 -        // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
 -        // in the class path in order to have applet support:
         if (opt.startsWith("-Djava.class.path="))
         {
 -            OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
             if (!sAddPath.isEmpty())
 +            {
                 opt += OStringChar(SAL_PATHSEPARATOR) + sAddPath;
 +                sAddPath.clear();
 +            }
         }
 #endif
         if (opt == "-Xint") {
@@ -742,6 +747,11 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
         }
 #endif
     }
 +#ifdef UNX
 +    if (!sAddPath.isEmpty()) {
 +        options.emplace_back("-Djava.class.path=" + sAddPath, nullptr);
 +    }
 +#endif
     std::unique_ptr<JavaVMOption[]> sarOptions(new JavaVMOption[options.size()]);
     for (std::vector<Option>::size_type i = 0; i != options.size(); ++i) {
 diff --git a/jvmfwk/source/framework.cxx b/jvmfwk/source/framework.cxx
 index 3212030..f532ebd 100644
 --- a/jvmfwk/source/framework.cxx
 +++ b/jvmfwk/source/framework.cxx
@@ -210,8 +210,12 @@ javaFrameworkError jfw_startVM(
                 //In direct mode the options are specified by bootstrap variables
                 //of the form UNO_JAVA_JFW_PARAMETER_1 .. UNO_JAVA_JFW_PARAMETER_n
                 vmParams = jfw::BootParams::getVMParameters();
 -                sUserClassPath =
 -                    "-Djava.class.path=" + jfw::BootParams::getClasspath();
 +                auto const cp = jfw::BootParams::getClasspath();
 +                if (!cp.isEmpty())
 +                {
 +                    sUserClassPath =
 +                        "-Djava.class.path=" + cp;
 +                }
             }
             else
                 OSL_ASSERT(false);
 diff --git a/jvmfwk/source/fwkbase.cxx b/jvmfwk/source/fwkbase.cxx
 index ece4dd2..93c32a7 100644
 --- a/jvmfwk/source/fwkbase.cxx
 +++ b/jvmfwk/source/fwkbase.cxx
@@ -460,6 +460,9 @@ OString makeClassPathOption(OUString const & sUserClassPath)
     sPaths = OUStringToOString(
         sBufCP.makeStringAndClear(), osl_getThreadTextEncoding());
 +    if (sPaths.isEmpty()) {
 +        return "";
 +    }
     OString sOptionClassPath = "-Djava.class.path=" + sPaths;
     return sOptionClassPath;
 -- 
 2.39.2
--- a/SOURCES/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
+++ b/SOURCES/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
@ -0,0 +1,69 @@
 From 6167f5815aefa78a70517c8e2acbdd7b9c9be27d Mon Sep 17 00:00:00 2001
 Message-ID: <6167f5815aefa78a70517c8e2acbdd7b9c9be27d.1703003067.git.erack@redhat.com>
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Fri, 3 Nov 2023 14:20:07 +0000
 Subject: [PATCH] escape url passed to gstreamer
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159583
 erAck: backported to 7.1.8.1
 ---
 avmedia/source/gstreamer/gstframegrabber.cxx | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-escape-url-passed-to-gstreamer.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-escape-url-passed-to-gstreamer.patch"
 diff --git a/avmedia/source/gstreamer/gstframegrabber.cxx b/avmedia/source/gstreamer/gstframegrabber.cxx
 index ece799d87530..25170a296e66 100644
 --- a/avmedia/source/gstreamer/gstframegrabber.cxx
 +++ b/avmedia/source/gstreamer/gstframegrabber.cxx
@@ -51,11 +51,9 @@ void FrameGrabber::disposePipeline()
 FrameGrabber::FrameGrabber( const OUString &rURL ) :
     FrameGrabber_BASE()
 {
 -    gchar *pPipelineStr;
 -    pPipelineStr = g_strdup_printf(
 -        "uridecodebin uri=%s ! videoconvert ! videoscale ! appsink "
 -        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"",
 -        OUStringToOString( rURL, RTL_TEXTENCODING_UTF8 ).getStr() );
 +    const char pPipelineStr[] =
 +        "uridecodebin name=source ! videoconvert ! videoscale ! appsink "
 +        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"";
     GError *pError = nullptr;
     mpPipeline = gst_parse_launch( pPipelineStr, &pError );
@@ -66,6 +64,12 @@ FrameGrabber::FrameGrabber( const OUString &rURL ) :
     }
     if( mpPipeline ) {
 +
 +        if (GstElement *pUriDecode = gst_bin_get_by_name(GST_BIN(mpPipeline), "source"))
 +            g_object_set(pUriDecode, "uri", OUStringToOString(rURL, RTL_TEXTENCODING_UTF8).getStr(), nullptr);
 +        else
 +            g_warning("Missing 'source' element in gstreamer pipeline");
 +
         // pre-roll
         switch( gst_element_set_state( mpPipeline, GST_STATE_PAUSED ) ) {
         case GST_STATE_CHANGE_FAILURE:
 --------------erAck-patch-parts--
--- a/SOURCES/0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch
+++ b/SOURCES/0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch
@ -0,0 +1,93 @@
 From 37d73a1ab94b43e03866d5a910cb58331543b8c3 Mon Sep 17 00:00:00 2001
 Message-ID: <37d73a1ab94b43e03866d5a910cb58331543b8c3.1703086247.git.erack@redhat.com>
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Fri, 3 Nov 2023 17:14:26 +0000
 Subject: [PATCH] add some protocols that don't make sense as floating frame
 targets
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159582
 erAck: backported to 7.1.8.1
 ---
 include/tools/urlobj.hxx     | 5 +++++
 sfx2/source/doc/iframe.cxx   | 5 ++++-
 tools/source/fsys/urlobj.cxx | 8 ++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
 diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx
 index 9d6820ddf241..dfd658722826 100644
 --- a/include/tools/urlobj.hxx
 +++ b/include/tools/urlobj.hxx
@@ -915,6 +915,11 @@ public:
     void changeScheme(INetProtocol eTargetScheme);
 +    // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot,
 +    // vnd.sun.star.script, etc. All the types of URLs which shouldn't
 +    // be accepted from an outside controlled source
 +    bool IsExoticProtocol() const;
 +
 private:
     // General Structure:
 diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
 index 150218b436e9..b81ce82fd32e 100644
 --- a/sfx2/source/doc/iframe.cxx
 +++ b/sfx2/source/doc/iframe.cxx
@@ -168,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load(
         xTrans->parseStrict( aTargetURL );
         INetURLObject aURLObject(aTargetURL.Complete);
 -        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
 +        if (aURLObject.IsExoticProtocol())
 +        {
 +            //SAL_WARN("sfx", "IFrameObject::load ignoring: " << aTargetURL.Complete);
             return false;
 +        }
         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
 diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
 index 764bb28ef623..2a9f7bc3d7dc 100644
 --- a/tools/source/fsys/urlobj.cxx
 +++ b/tools/source/fsys/urlobj.cxx
@@ -4829,4 +4829,12 @@ OUString INetURLObject::CutExtension()
         ? aTheExtension : OUString();
 }
 +bool INetURLObject::IsExoticProtocol() const
 +{
 +    return m_eScheme == INetProtocol::Slot ||
 +           m_eScheme == INetProtocol::Macro ||
 +           m_eScheme == INetProtocol::Uno ||
 +           isSchemeEqualTo(u"vnd.sun.star.script");
 +}
 +
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 --------------erAck-patch-parts--
--- a/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch
+++ b/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch
@ -0,0 +1,29 @@
 From 3c25a1e4885a91b1a2fbfd873633f055caa50745 Mon Sep 17 00:00:00 2001
 From: Caolán McNamara <caolan.mcnamara@collabora.com>
 Date: Wed, 27 Mar 2024 17:07:20 +0000
 Subject: [PATCH] add notify for script use
 Change-Id: I84af197cec7755f6803a578e1e21c03966ad5f3e
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165410
 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit a4a5c6b63599bca1f084bb90875f6fd8e15184ac)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167421
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 ---
 diff --git a/xmloff/source/draw/eventimp.cxx b/xmloff/source/draw/eventimp.cxx
 index f9e10c1..fcc36f9 100644
 --- a/xmloff/source/draw/eventimp.cxx
 +++ b/xmloff/source/draw/eventimp.cxx
@@ -231,6 +231,9 @@
     if( maData.mbValid )
         maData.mbValid = !sEventName.isEmpty();
 +
 +    if (!maData.msMacroName.isEmpty())
 +        rImp.NotifyMacroEventRead();
 }
 SvXMLImportContextRef SdXMLEventContext::CreateChildContext( sal_uInt16 nPrefix, const OUString& rLocalName, const Reference< XAttributeList>& xAttrList )
--- a/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch
+++ b/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch
@ -0,0 +1,81 @@
 From 4e997c62fd6edf6c3fe9e553cc92c77fd48f039c Mon Sep 17 00:00:00 2001
 Message-ID: <4e997c62fd6edf6c3fe9e553cc92c77fd48f039c.1723718921.git.erack@redhat.com>
 From: Sarper Akdemir <sarper.akdemir@allotropia.de>
 Date: Tue, 11 Jun 2024 12:39:36 +0200
 Subject: [PATCH] remove ability to trust not validated macro signatures in
 high security
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Giving the user the option to determine if they should trust an
 invalid signature in HIGH macro security doesn't make sense.
 CommonName of the signature is the most prominent feature presented
 and the CommonName of a certificate can be easily forged for an
 invalid signature, tricking the user into accepting an invalid
 signature.
 in the HIGH macro security setting only show the pop-up to
 enable/disable signed macro if the certificate signature can be
 validated.
 cherry-picked without UI/String altering bits for 24-2
 Change-Id: Ia766fb701660160ee5dc9f6e077f4012a44ce721
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168667
 Tested-by: Jenkins
 Reviewed-by: Sarper Akdemir <sarper.akdemir@allotropia.de>
 (cherry picked from commit 2beaa3be3829303e948d401f492dbfd239d60aad)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169525
 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171306
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171314
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171315
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171317
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171323
 ---
 sfx2/source/doc/docmacromode.cxx | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-remove-ability-to-trust-not-validated-macro-signatur.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-remove-ability-to-trust-not-validated-macro-signatur.patch"
 diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
 index 8a617b1785c6..997a8f739395 100644
 --- a/sfx2/source/doc/docmacromode.cxx
 +++ b/sfx2/source/doc/docmacromode.cxx
@@ -229,14 +229,18 @@ namespace sfx2
             // check whether the document is signed with trusted certificate
             if ( nMacroExecutionMode != MacroExecMode::FROM_LIST )
             {
 +                SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState();
 +
                 // the trusted macro check will also retrieve the signature state ( small optimization )
                 const SvtSecurityOptions aSecOption;
                 const bool bAllowUIToAddAuthor = nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_NO_WARN
                                                  && (nMacroExecutionMode == MacroExecMode::ALWAYS_EXECUTE
 -                                                     || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors));
 +                                                     || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors))
 +                                                 && (nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_WARN
 +                                                     || nSignatureState == SignatureState::OK);
 +
                 const bool bHasTrustedMacroSignature = m_xData->m_rDocumentAccess.hasTrustedScriptingSignature(bAllowUIToAddAuthor);
 -                SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState();
                 if ( nSignatureState == SignatureState::BROKEN )
                 {
                     if (!bAllowUIToAddAuthor)
 --------------erAck-patch-parts--
--- a/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
+++ b/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
@ -0,0 +1,50 @@
 From 78fd31b17931e1217d3b11fcbd13a41d79d99055 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Wed, 23 Sep 2020 11:41:05 +0200
 Subject: [PATCH] Convert attribute value to UTF-8 when passing it to libxml2
 Using toUtf8, requiring the OUString to actually contain well-formed data, but
 which is likely OK for this test-code--only function, and is also what similar
 dumpAsXml functions e.g. in editeng/source/items/textitem.cxx already use.
 This appears to have been broken ever since the code's introduction in
 553f10c71a2cc92f5f5890e24948f5277e3d2758 "add dumpAsXml() to more pool items",
 and it would typically only have written the leading zero or one
 (depending on the architecture's endianness) characters.  (I ran across it on
 big-endian s390x, where CppunitTest_sd_tiledrendering
 SdTiledRenderingTest::testTdf104405 failed because of
 > Entity: line 2: parser error : Input is not proper UTF-8, indicate encoding !
 > Bytes: 0xCF 0x22 0x2F 0x3E
 > ation=""/><SfxPoolItem whichId="4017" typeName="13SvxBulletItem" presentation="%
 >                                                                                ^
 apparently reported from within libxml2.)
 Change-Id: I4b116d3be84098bd8b8a13b6937da70a1ee02c7f
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103236
 Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit fd9422febc384208558487bfe4a69ec89ab0ddca)
 ---
 svl/source/items/poolitem.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/svl/source/items/poolitem.cxx b/svl/source/items/poolitem.cxx
 index ec37b68d3417..ad07a0b60b4b 100644
 --- a/svl/source/items/poolitem.cxx
 +++ b/svl/source/items/poolitem.cxx
@@ -548,7 +548,8 @@ void SfxPoolItem::dumpAsXml(xmlTextWriterPtr pWriter) const
     OUString rText;
     IntlWrapper aIntlWrapper(SvtSysLocale().GetUILanguageTag());
     if (GetPresentation( SfxItemPresentation::Complete, MapUnit::Map100thMM, MapUnit::Map100thMM, rText, aIntlWrapper))
 -        xmlTextWriterWriteAttribute(pWriter, BAD_CAST("presentation"), BAD_CAST(rText.getStr()));
 +        xmlTextWriterWriteAttribute(
 +            pWriter, BAD_CAST("presentation"), BAD_CAST(rText.toUtf8().getStr()));
     xmlTextWriterEndElement(pWriter);
 }
 -- 
 2.33.1
--- a/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
+++ b/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
@ -0,0 +1,65 @@
 From 41594786266265c1b7d5116ab85b38af0cd1fd59 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Wed, 23 Sep 2020 12:01:35 +0200
 Subject: [PATCH] Correctly read PNG into bitmaps N32BitTcA... formats (where
 alpha comes first)
 This appears to be a regression introduced with
 86ea64f216819696cd86d1926aff0a138ace2baf "Support for native 32bit Bitmap in VCL
 and SVP (cairo) backend".  It caused CppunitTest_vcl_png_test to fail on
 (big-endian) Linux s390x with
 > vcl/qa/cppunit/png/PngFilterTest.cxx:176:PngFilterTest::testPng
 > equality assertion failed
 > - Expected: c[ff000040]
 > - Actual  : c[0000ff40]
 where eFormat happens to be ScanlineFormat::N32BitTcArgb, vs.
 ScanlineFormat::N32BitTcBgra on e.g. Linux x86-64 (and which thus didn't notice
 the lack of support for N32BitTcA... formats where alpha goes first instead of
 last).
 Change-Id: Id6030468718f6ef831b42f2b5ad7ba2c4c46a805
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103240
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 0387077e6647d7a30fd36d4ec41dfc559afe45c3)
 ---
 vcl/source/filter/png/PngImageReader.cxx | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/vcl/source/filter/png/PngImageReader.cxx b/vcl/source/filter/png/PngImageReader.cxx
 index 958cae34eb46..6e9f3825face 100644
 --- a/vcl/source/filter/png/PngImageReader.cxx
 +++ b/vcl/source/filter/png/PngImageReader.cxx
@@ -188,6 +188,8 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
                     for (auto& rRow : aRows)
                         rRow.resize(aRowSizeBytes, 0);
 +                    auto const alphaFirst = (eFormat == ScanlineFormat::N32BitTcAbgr
 +                                             || eFormat == ScanlineFormat::N32BitTcArgb);
                     for (int pass = 0; pass < nNumberOfPasses; pass++)
                     {
                         for (png_uint_32 y = 0; y < height; y++)
@@ -199,10 +201,17 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
                             for (size_t i = 0; i < aRowSizeBytes; i += 4)
                             {
                                 sal_Int8 alpha = pRow[i + 3];
 +                                if (alphaFirst)
 +                                {
 +                                    pScanline[iColor++] = alpha;
 +                                }
                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 0], alpha);
                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 1], alpha);
                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 2], alpha);
 -                                pScanline[iColor++] = alpha;
 +                                if (!alphaFirst)
 +                                {
 +                                    pScanline[iColor++] = alpha;
 +                                }
                             }
                         }
                     }
 -- 
 2.33.1
--- a/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
+++ b/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
@ -0,0 +1,116 @@
 From 96b088a62174a70441ebe959495756e9d86203a2 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Thu, 24 Sep 2020 14:51:16 +0200
 Subject: [PATCH] Fix endianness issues in OOX crypto routines
 ...without which CppunitTest_sw_ooxmlencryption failed on (big-endian) s390x:
 * The 32-bit segment counter in AgileEngine::de-/encrypt apparently needs to be
  stored in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
  ultimately succeeded, whereas otherwise it failed).
 * The UTF-16 string in Standard2007Engine::calculateEncryptionKey apparently
  needs to be in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
  ultimately succeeded, whereas otherwise it failed).
 * The various 32-bit values in the EncryptionStandardHeader and
  EncryptionVerifierAES data structures apparently need to be written out in LSB
  format in Standard2007Engine::writeEncryptionInfo, given that they are always
  read in LSB format in Standard2007Engine::readEncryptionInfo.
 Change-Id: I3a1efbfe324b1bbd539b88dc5d40bb44f9676ffa
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103315
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 646a69757b928aeaf6e0d0d41c4b30c02803a3a3)
 ---
 oox/source/crypto/AgileEngine.cxx        | 16 +++++++++-----
 oox/source/crypto/Standard2007Engine.cxx | 28 +++++++++++++++++-------
 2 files changed, 30 insertions(+), 14 deletions(-)
 diff --git a/oox/source/crypto/AgileEngine.cxx b/oox/source/crypto/AgileEngine.cxx
 index 7c2a0e9c93d2..0fc972bf2ca5 100644
 --- a/oox/source/crypto/AgileEngine.cxx
 +++ b/oox/source/crypto/AgileEngine.cxx
@@ -457,9 +457,11 @@ bool AgileEngine::decrypt(BinaryXInputStream& aInputStream,
     while ((inputLength = aInputStream.readMemory(inputBuffer.data(), inputBuffer.size())) > 0)
     {
 -        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&segment);
 -        sal_uInt8* segmentEnd   = segmentBegin + sizeof(segment);
 -        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
 +        auto p = saltWithBlockKey.begin() + saltSize;
 +        p[0] = segment & 0xFF;
 +        p[1] = (segment >> 8) & 0xFF;
 +        p[2] = (segment >> 16) & 0xFF;
 +        p[3] = segment >> 24;
         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
@@ -800,9 +802,11 @@ void AgileEngine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputS
                         inputLength : oox::core::roundUp(inputLength, sal_uInt32(mInfo.blockSize));
         // Update Key
 -        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&nSegment);
 -        sal_uInt8* segmentEnd   = segmentBegin + nSegmentByteSize;
 -        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
 +        auto p = saltWithBlockKey.begin() + saltSize;
 +        p[0] = nSegment & 0xFF;
 +        p[1] = (nSegment >> 8) & 0xFF;
 +        p[2] = (nSegment >> 16) & 0xFF;
 +        p[3] = nSegment >> 24;
         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
 diff --git a/oox/source/crypto/Standard2007Engine.cxx b/oox/source/crypto/Standard2007Engine.cxx
 index 38c4e03baf15..e96fc8f841f2 100644
 --- a/oox/source/crypto/Standard2007Engine.cxx
 +++ b/oox/source/crypto/Standard2007Engine.cxx
@@ -79,12 +79,12 @@ bool Standard2007Engine::calculateEncryptionKey(const OUString& rPassword)
     std::vector<sal_uInt8> initialData(saltSize + passwordByteLength);
     std::copy(saltArray, saltArray + saltSize, initialData.begin());
 -    const sal_uInt8* passwordByteArray = reinterpret_cast<const sal_uInt8*>(rPassword.getStr());
 -
 -    std::copy(
 -        passwordByteArray,
 -        passwordByteArray + passwordByteLength,
 -        initialData.begin() + saltSize);
 +    auto p = initialData.begin() + saltSize;
 +    for (sal_Int32 i = 0; i != rPassword.getLength(); ++i) {
 +        auto c = rPassword[i];
 +        *p++ = c & 0xFF;
 +        *p++ = c >> 8;
 +    }
     // use "hash" vector for result of sha1 hashing
     // calculate SHA1 hash of initialData
@@ -223,11 +223,23 @@ void Standard2007Engine::writeEncryptionInfo(BinaryXOutputStream& rStream)
     sal_uInt32 headerSize = encryptionHeaderSize + cspNameSize;
     rStream.WriteUInt32(headerSize);
 -    rStream.writeMemory(&mInfo.header, encryptionHeaderSize);
 +    rStream.WriteUInt32(mInfo.header.flags);
 +    rStream.WriteUInt32(mInfo.header.sizeExtra);
 +    rStream.WriteUInt32(mInfo.header.algId);
 +    rStream.WriteUInt32(mInfo.header.algIdHash);
 +    rStream.WriteUInt32(mInfo.header.keyBits);
 +    rStream.WriteUInt32(mInfo.header.providedType);
 +    rStream.WriteUInt32(mInfo.header.reserved1);
 +    rStream.WriteUInt32(mInfo.header.reserved2);
     rStream.writeUnicodeArray(lclCspName);
     rStream.WriteUInt16(0);
 -    rStream.writeMemory(&mInfo.verifier, sizeof(msfilter::EncryptionVerifierAES));
 +    rStream.WriteUInt32(mInfo.verifier.saltSize);
 +    rStream.writeMemory(&mInfo.verifier.salt, sizeof mInfo.verifier.salt);
 +    rStream.writeMemory(&mInfo.verifier.encryptedVerifier, sizeof mInfo.verifier.encryptedVerifier);
 +    rStream.WriteUInt32(mInfo.verifier.encryptedVerifierHashSize);
 +    rStream.writeMemory(
 +        &mInfo.verifier.encryptedVerifierHash, sizeof mInfo.verifier.encryptedVerifierHash);
 }
 void Standard2007Engine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputStream,
 -- 
 2.33.1
--- a/SOURCES/0001-Flatpak-Add-app-bin-libreoffice-app-libreoffice-prog.patch
+++ b/SOURCES/0001-Flatpak-Add-app-bin-libreoffice-app-libreoffice-prog.patch
@ -0,0 +1,64 @@
 From acca5c87e73255db350a02d13bf34a62efaf9c93 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Tue, 21 Apr 2020 14:07:24 +0200
 Subject: [PATCH] Flatpak: Add /app/bin/libreoffice ->
 /app/libreoffice/program/soffice symlink
 Which removes the need to rewrite the
  Exec=${UNIXBASISROOTNAME}
 lines from sysui/desktop/menus/*.desktop, and helps to harmonize the plain
 Flatpak build with the one done from Fedora RPMs (see
 <https://src.fedoraproject.org/flatpaks/libreoffice>).
 (Also change the manifest command from an absolute path to a filename relative
 to PATH.  It is not clear to me which one would be better or more conventional,
 but at least <https://docs.flatpak.org/en/latest/manifests.html> also uses just
 a filename in its example.)
 Change-Id: I69c380b84503bf3d85801093fb92567852ceb00b
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/92837
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 ---
 solenv/bin/assemble-flatpak.sh | 4 ++--
 solenv/flatpak-manifest.in     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 diff --git a/solenv/bin/assemble-flatpak.sh b/solenv/bin/assemble-flatpak.sh
 index b4bce2d4d172..0738fcd59ad2 100755
 --- a/solenv/bin/assemble-flatpak.sh
 +++ b/solenv/bin/assemble-flatpak.sh
@@ -14,13 +14,13 @@
 set -e
 cp -r "${PREFIXDIR?}"/lib/libreoffice /app/
 +ln -s /app/libreoffice/program/soffice /app/bin/libreoffice
 ## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
 mkdir -p /app/share/applications
 for i in "${PREFIXDIR?}"/share/applications/libreoffice-*.desktop
 do
 - sed -e 's,^Exec=libreoffice,Exec=/app/libreoffice/program/soffice,' \
 -  -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
 + sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
   >/app/share/applications/org.libreoffice.LibreOffice."${i#"${PREFIXDIR?}"/share/applications/libreoffice-}"
 done
 mv /app/share/applications/org.libreoffice.LibreOffice.startcenter.desktop \
 diff --git a/solenv/flatpak-manifest.in b/solenv/flatpak-manifest.in
 index 9f64a142dd68..754b6b6dbbe1 100644
 --- a/solenv/flatpak-manifest.in
 +++ b/solenv/flatpak-manifest.in
@@ -6,7 +6,7 @@
     "sdk-extensions": [
         "org.freedesktop.Sdk.Extension.openjdk11"
     ],
 -    "command": "/app/libreoffice/program/soffice",
 +    "command": "libreoffice",
     "modules": [
         {
             "name": "openjdk",
 -- 
 2.26.0
--- a/SOURCES/0001-Keep-the-still-relevant-part-of-external-icu-icu4c-u.patch
+++ b/SOURCES/0001-Keep-the-still-relevant-part-of-external-icu-icu4c-u.patch
@ -1,67 +0,0 @@
 From 811575c105b0a2bc597afda2f84a087199447ae5 Mon Sep 17 00:00:00 2001
 Message-Id: <811575c105b0a2bc597afda2f84a087199447ae5.1531842164.git.erack@redhat.com>
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Wed, 18 Apr 2018 16:35:55 +0200
 Subject: [PATCH] Keep the still relevant part of
 external/icu/icu4c-ubsan.patch.1
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 ...which f247f08e370626bbb427acd8f4a400fd875350a3 "Upgrade to ICU 61.1" had
 removed completely, in error.
 Change-Id: I7239011561851333cac58e54e4e7d590b8529dbc
 ---
 external/icu/UnpackedTarball_icu.mk |  1 +
 external/icu/icu4c-ubsan.patch.1    | 14 ++++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 external/icu/icu4c-ubsan.patch.1
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-Keep-the-still-relevant-part-of-external-icu-icu4c-u.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-Keep-the-still-relevant-part-of-external-icu-icu4c-u.patch"
 diff --git a/external/icu/UnpackedTarball_icu.mk b/external/icu/UnpackedTarball_icu.mk
 index b81cdaab6242..c789e6eb8d84 100644
 --- a/external/icu/UnpackedTarball_icu.mk
 +++ b/external/icu/UnpackedTarball_icu.mk
@@ -27,6 +27,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,icu,\
 	external/icu/icu4c-solarisgcc.patch.1 \
 	external/icu/icu4c-mkdir.patch.1 \
 	external/icu/icu4c-$(if $(filter ANDROID,$(OS)),android,rpath).patch.1 \
 +	external/icu/icu4c-ubsan.patch.1 \
 	external/icu/icu4c-icu11100.patch.1 \
 	external/icu/icu4c-scriptrun.patch.1 \
 	external/icu/icu4c-rtti.patch.1 \
 diff --git a/external/icu/icu4c-ubsan.patch.1 b/external/icu/icu4c-ubsan.patch.1
 new file mode 100644
 index 000000000000..ea9f13fd85cd
 --- /dev/null
 +++ b/external/icu/icu4c-ubsan.patch.1
@@ -0,0 +1,14 @@
 +diff -ur icu.org/source/common/ubidiimp.h icu/source/common/ubidiimp.h
 +--- icu.org/source/common/ubidiimp.h	2017-02-03 19:57:23.000000000 +0100
 ++++ icu/source/common/ubidiimp.h	2017-04-21 22:46:25.374651159 +0200
 +@@ -198,8 +198,8 @@
 + /* in a Run, logicalStart will get this bit set if the run level is odd */
 + #define INDEX_ODD_BIT (1UL<<31)
 + 
 +-#define MAKE_INDEX_ODD_PAIR(index, level) ((index)|((int32_t)(level)<<31))
 +-#define ADD_ODD_BIT_FROM_LEVEL(x, level)  ((x)|=((int32_t)(level)<<31))
 ++#define MAKE_INDEX_ODD_PAIR(index, level) ((index)|((uint32_t)(level)<<31))
 ++#define ADD_ODD_BIT_FROM_LEVEL(x, level)  ((x)|=((uint32_t)(level)<<31))
 + #define REMOVE_ODD_BIT(x)                 ((x)&=~INDEX_ODD_BIT)
 + 
 + #define GET_INDEX(x)   ((x)&~INDEX_ODD_BIT)
 --------------erAck-patch-parts--
--- a/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
+++ b/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
@ -0,0 +1,80 @@
 From b66d735cf3dc8b80783cb161c0aff5b990db1bb0 Mon Sep 17 00:00:00 2001
 From: Eike Rathke <erack@redhat.com>
 Date: Thu, 16 Feb 2023 20:20:31 +0100
 Subject: [PATCH 1/3] Obtain actual 0-parameter count for OR(), AND() and
 1-parameter functions
 OR and AND for legacy infix notation are classified as binary
 operators but in fact are functions with parameter count. In case
 no argument is supplied, GetByte() returns 0 and for that case the
 implicit binary operator 2 parameters were wrongly assumed.
 Similar for functions expecting 1 parameter, without argument 1
 was assumed. For "real" unary and binary operators the compiler
 already checks parameters. Omit OR and AND and 1-parameter
 functions from this implicit assumption and return the actual 0
 count.
 Change-Id: Ie05398c112a98021ac2875cf7b6de994aee9d882
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147173
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit e7ce9bddadb2db222eaa5f594ef1de2e36d57e5c)
 Conflicts:
        sc/source/core/tool/interpr4.cxx
 ---
 formula/source/core/api/token.cxx | 13 +++++--------
 sc/source/core/tool/interpr4.cxx  | 10 +++++++++-
 2 files changed, 14 insertions(+), 9 deletions(-)
 diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
 index 17594207234f..0db0c3464610 100644
 --- a/formula/source/core/api/token.cxx
 +++ b/formula/source/core/api/token.cxx
@@ -95,17 +95,14 @@ sal_uInt8 FormulaToken::GetParamCount() const
         return 0;       // parameters and specials
                         // ocIf... jump commands not for FAP, have cByte then
 //2do: bool parameter whether FAP or not?
 -    else if ( GetByte() )
 +    else if (GetByte())
         return GetByte();   // all functions, also ocExternal and ocMacro
 -    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP)
 -        return 2;           // binary
 -    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP)
 -            || eOp == ocPercentSign)
 -        return 1;           // unary
 +    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP && eOp != ocAnd && eOp != ocOr)
 +        return 2;           // binary operators, compiler checked; OR and AND legacy but are functions
 +    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP) || eOp == ocPercentSign)
 +        return 1;           // unary operators, compiler checked
     else if (SC_OPCODE_START_NO_PAR <= eOp && eOp < SC_OPCODE_STOP_NO_PAR)
         return 0;           // no parameter
 -    else if (SC_OPCODE_START_1_PAR <= eOp && eOp < SC_OPCODE_STOP_1_PAR)
 -        return 1;           // one parameter
     else if (FormulaCompiler::IsOpCodeJumpCommand( eOp ))
         return 1;           // only the condition counts as parameter
     else
 diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
 index eb3fb987c034..94235c33eaef 100644
 --- a/sc/source/core/tool/interpr4.cxx
 +++ b/sc/source/core/tool/interpr4.cxx
@@ -4012,7 +4012,15 @@ StackVar ScInterpreter::Interpret()
                 else if (sp >= pCur->GetParamCount())
                     nStackBase = sp - pCur->GetParamCount();
                 else
 -                    nStackBase = sp;    // underflow?!?
 +                {
 +                    SAL_WARN("sc.core", "Stack anomaly at " << aPos.Format(
 +                                ScRefFlags::VALID | ScRefFlags::FORCE_DOC | ScRefFlags::TAB_3D, pDok)
 +                            << "  eOp: " << static_cast<int>(eOp)
 +                            << "  params: " << static_cast<int>(pCur->GetParamCount())
 +                            << "  nStackBase: " << nStackBase << "  sp: " << sp);
 +                    nStackBase = sp;
 +                    assert(!"underflow");
 +                }
             }
             switch( eOp )
 -- 
 2.41.0
--- a/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
+++ b/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
@ -0,0 +1,59 @@
 From 9f393ee10ae198063bbe3b71c2c87262e7880a34 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Wed, 23 Sep 2020 11:53:11 +0200
 Subject: [PATCH] Read MOSDocumentLockFile UTF-16 string data with same
 endianness
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...as MSODocumentLockFile::WriteEntryToStream has written it to (i.e.,
 always as UTF-16LE, assuming that is actually the right format to use).  The
 discrepancy between writing and reading the string data appears to be present
 ever since the code's introduction in 5db1e20b8b0942dac2d50f3cd34532bb61147020
 "Introduce new lockfile handler for MSO like lockfiles".
 This caused CppunitTest_svl_lockfiles to fail on (big-endian) s390x Linux with
 > svl/qa/unit/lockfiles/test_lockfiles.cxx:578:(anonymous namespace)::LockfileTest::testWordLockFileRT
 > equality assertion failed
 > - Expected: LockFile Test
 > - Actual  : 䰀漀挀欀䘀椀氀攀 吀攀猀琀
 etc.
 Change-Id: I97267aa14a3a926e7fd7bb1d2ce7d2de05d52a64
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103238
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 1b9fa11a0869246fe0433b79aab30dd216cf92b6)
 ---
 svl/source/misc/msodocumentlockfile.cxx | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
 diff --git a/svl/source/misc/msodocumentlockfile.cxx b/svl/source/misc/msodocumentlockfile.cxx
 index 9650db03999f..0c857ffb53ec 100644
 --- a/svl/source/misc/msodocumentlockfile.cxx
 +++ b/svl/source/misc/msodocumentlockfile.cxx
@@ -228,8 +228,16 @@ LockFileEntry MSODocumentLockFile::GetLockData()
                 nUTF16Len = *++pBuf; // use Excel/PowerPoint position
             if (nUTF16Len > 0 && nUTF16Len <= 52) // skip wrong format
 -                aResult[LockFileComponent::OOOUSERNAME]
 -                    = OUString(reinterpret_cast<const sal_Unicode*>(pBuf + 2), nUTF16Len);
 +            {
 +                OUStringBuffer str(nUTF16Len);
 +                sal_uInt8 const* p = reinterpret_cast<sal_uInt8 const*>(pBuf + 2);
 +                for (int i = 0; i != nUTF16Len; ++i)
 +                {
 +                    str.append(sal_Unicode(p[0] | (sal_uInt32(p[1]) << 8)));
 +                    p += 2;
 +                }
 +                aResult[LockFileComponent::OOOUSERNAME] = str.makeStringAndClear();
 +            }
         }
     }
     return aResult;
 -- 
 2.33.1
--- a/SOURCES/0001-Related-rhbz-1618703-Properly-handle-failure-decodin.patch
+++ b/SOURCES/0001-Related-rhbz-1618703-Properly-handle-failure-decodin.patch
@ -1,94 +0,0 @@
 From 03ab9306c70df34d7824f700d5635e8b458e6d6d Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Thu, 23 Aug 2018 16:45:34 +0200
 Subject: [PATCH 1/5] Related rhbz#1618703: Properly handle failure decoding
 master password
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...when e.g. FIPS mode makes PasswordContainer::DecodePasswords fail by throwing
 an exception which needs to be caught in PasswordContainerHelper::addRecord (in
 uui/source/passwordcontainer.cxx, but which only catches NoMasterException, not
 generic RuntimeException)
 Change-Id: I877bb5126e79ac2c90b11ef6d31bf81a2927f409
 Reviewed-on: https://gerrit.libreoffice.org/59511
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit e17987f4bd54fec7e0d94bdefdb94809255b3436)
 Reviewed-on: https://gerrit.libreoffice.org/59568
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 24b3d08018b6350d5e60615eb375b337ab1b4f75)
 ---
 svl/source/passwordcontainer/passwordcontainer.cxx | 11 ++++++-----
 svl/source/passwordcontainer/passwordcontainer.hxx |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)
 diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
 index c2e8b7100028..6d4bb02427ac 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.cxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.cxx
@@ -417,7 +417,7 @@ void SAL_CALL PasswordContainer::disposing( const EventObject& )
     }
 }
 -std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aMasterPasswd )
 +std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
 {
     if( !aMasterPasswd.isEmpty() )
     {
@@ -463,7 +463,8 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
     // problems with decoding
     OSL_FAIL( "Problem with decoding" );
 -    throw RuntimeException("Can't decode!" );
 +    throw css::task::NoMasterException(
 +        "Can't decode!", css::uno::Reference<css::uno::XInterface>(), mode);
 }
 OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPasswd )
@@ -586,7 +587,7 @@ UserRecord PasswordContainer::CopyToUserRecord( const NamePassRecord& aRecord, b
     {
         try
         {
 -            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), GetMasterPassword( aHandler ) );
 +            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
             aPasswords.insert( aPasswords.end(), aDecodedPasswords.begin(), aDecodedPasswords.end() );
         }
         catch( NoMasterException& )
@@ -848,7 +849,7 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
                     }
                     else
                     {
 -                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass ) );
 +                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
                         if( aRM.empty() || aPass != aRM[0] )
                         {
                             bAskAgain = true;
@@ -1005,7 +1006,7 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
             {
                 sal_Int32 oldLen = aUsers.getLength();
                 aUsers.realloc( oldLen + 1 );
 -                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), GetMasterPassword( xHandler ) ) ) );
 +                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
             }
         if( aUsers.getLength() )
 diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
 index 67ad63e72722..a1190549eb77 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.hxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.hxx
@@ -268,7 +268,7 @@ css::task::UrlRecord find(
                               const css::uno::Reference< css::task::XInteractionHandler >& Handler );
     /// @throws css::uno::RuntimeException
 -    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aMasterPassword );
 +    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
     /// @throws css::uno::RuntimeException
     static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPassword );
 -- 
 2.17.1
--- a/SOURCES/0001-Related-tdf-105998-except-cut-and-paste-as-bitmap-in.patch
+++ b/SOURCES/0001-Related-tdf-105998-except-cut-and-paste-as-bitmap-in.patch
@ -1,74 +0,0 @@
 From 15cdcd0346b7aa98d4697edec8aeea9c810efa62 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 5 Dec 2017 17:13:28 +0000
 Subject: [PATCH] Related: tdf#105998 except cut and paste as bitmap instead of
 export
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Take a drawing rectangle in draw and cut and paste as bitmap to writer.  The
 hairline border along the very right/bottom edge of the bitmap appear missing.
 fallback to default handlers which can distort the hairline to be visible
 Change-Id: Iedb580f65879628839c83e41092745ae7c11267c
 Reviewed-on: https://gerrit.libreoffice.org/45902
 Tested-by: Jenkins <ci@libreoffice.org>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 ---
 .../source/processor2d/vclpixelprocessor2d.cxx     | 25 +++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)
 diff --git a/drawinglayer/source/processor2d/vclpixelprocessor2d.cxx b/drawinglayer/source/processor2d/vclpixelprocessor2d.cxx
 index 9c21c83ee..5c5c0bb 100644
 --- a/drawinglayer/source/processor2d/vclpixelprocessor2d.cxx
 +++ b/drawinglayer/source/processor2d/vclpixelprocessor2d.cxx
@@ -41,6 +41,7 @@
 #include "helperwrongspellrenderer.hxx"
 #include <drawinglayer/primitive2d/fillhatchprimitive2d.hxx>
 #include <basegfx/polygon/b2dpolygontools.hxx>
 +#include <basegfx/polygon/b2dpolypolygontools.hxx>
 #include <vcl/hatch.hxx>
 #include <tools/diagnose_ex.h>
 #include <com/sun/star/awt/PosSize.hpp>
@@ -210,10 +211,6 @@ namespace drawinglayer
                 maBColorModifierStack.getModifiedColor(
                     rSource.getLineAttribute().getColor()));
 -            mpOutputDevice->SetFillColor();
 -            mpOutputDevice->SetLineColor(Color(aLineColor));
 -            aHairLinePolyPolygon.transform(maCurrentTransformation);
 -
             double fLineWidth(rSource.getLineAttribute().getWidth());
             if(basegfx::fTools::more(fLineWidth, 0.0))
@@ -234,6 +231,24 @@ namespace drawinglayer
                 fLineWidth = 0.0;
             }
 +            //Related: tdf#105998 cut and paste as bitmap of shape from draw to
 +            //writer.  If we are a hairline along the very right/bottom edge of
 +            //the canvas then fallback to defaults which can distort the
 +            //hairline inside the paintable area
 +            if (fLineWidth == 0.0)
 +            {
 +                Size aSize = mpOutputDevice->GetOutputSize();
 +                basegfx::B2DRange aRange = aHairLinePolyPolygon.getB2DRange();
 +                basegfx::B2DRange aOutputRange = aRange;
 +                aOutputRange.transform(maCurrentTransformation);
 +                if (std::round(aOutputRange.getMaxX()) == aSize.Width() || std::round(aOutputRange.getMaxY()) == aSize.Height())
 +                    return false;
 +            }
 +
 +            mpOutputDevice->SetFillColor();
 +            mpOutputDevice->SetLineColor(Color(aLineColor));
 +            aHairLinePolyPolygon.transform(maCurrentTransformation);
 +
             bool bHasPoints(false);
             bool bTryWorked(false);
 -- 
 2.9.5
--- a/SOURCES/0001-Related-tdf-106100-recover-mangled-svg-in-presentati.patch
+++ b/SOURCES/0001-Related-tdf-106100-recover-mangled-svg-in-presentati.patch
@ -1,67 +0,0 @@
 From a74837a0e7c7259e4396aa5f05cf1384e256db35 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 20 Feb 2017 16:04:58 +0000
 Subject: [PATCH] Related: tdf#106100 recover mangled svg in presentations
 Change-Id: I77b452aa69a8341aa30e1e93d0d5ee8160533095
 ---
 svgio/Module_svgio.mk                 |  4 ----
 svgio/source/svgreader/svgsvgnode.cxx | 27 +++------------------------
 2 files changed, 3 insertions(+), 28 deletions(-)
 diff --git a/svgio/Module_svgio.mk b/svgio/Module_svgio.mk
 index 29ef97d..8b827fc 100644
 --- a/svgio/Module_svgio.mk
 +++ b/svgio/Module_svgio.mk
@@ -22,8 +22,4 @@ $(eval $(call gb_Module_add_targets,svgio,\
     Library_svgio \
 ))
 -$(eval $(call gb_Module_add_check_targets,svgio,\
 -    CppunitTest_svgio \
 -))
 -
 # vim: set noet ts=4 sw=4:
 diff --git a/svgio/source/svgreader/svgsvgnode.cxx b/svgio/source/svgreader/svgsvgnode.cxx
 index 7800666..087c621 100644
 --- a/svgio/source/svgreader/svgsvgnode.cxx
 +++ b/svgio/source/svgreader/svgsvgnode.cxx
@@ -522,32 +522,11 @@ namespace svgio
                                 }
                                 else
                                 {
 -                                    // There exists no parent to resolve relative width or height.
 -                                    // Use child size as fallback and expand to aspect ratio given
 -                                    // by the viewBox. No mapping.
 -                                    // We get viewport >= content, therefore no clipping.
 -                                    bNeedsMapping = false;
 -                                    const basegfx::B2DRange aChildRange(
 -                                        aSequence.getB2DRange(
 -                                            drawinglayer::geometry::ViewInformation2D()));
 -                                    const double fChildWidth(aChildRange.getWidth());
 -                                    const double fChildHeight(aChildRange.getHeight());
 -                                    const double fLeft(aChildRange.getMinX());
 -                                    const double fTop(aChildRange.getMinY());
 -                                    if ( fChildWidth / fViewBoxWidth > fChildHeight / fViewBoxHeight )
 -                                    {  // expand y
 -                                        fW = fChildWidth;
 -                                        fH = fChildWidth / fViewBoxRatio;
 -                                    }
 -                                    else
 -                                    {  // expand x
 -                                        fH = fChildHeight;
 -                                        fW = fChildHeight * fViewBoxRatio;
 -                                    }
 -                                    aSvgCanvasRange = basegfx::B2DRange(fLeft, fTop, fLeft + fW, fTop + fH);
 +                                    fW = fViewBoxWidth;
 +                                    fH = fViewBoxHeight;
 +                                    aSvgCanvasRange = basegfx::B2DRange(0.0, 0.0, fW, fH);
                                 }
 -
                                 if (bNeedsMapping)
                                 {
                                     // create mapping
 -- 
 2.9.3
--- a/SOURCES/0001-Related-tdf-127782-resize-the-print-dialog-to-its-op.patch
+++ b/SOURCES/0001-Related-tdf-127782-resize-the-print-dialog-to-its-op.patch
--- a/SOURCES/0001-Resolves-rhbz-1647507-try-inputted-password-as-both-.patch
+++ b/SOURCES/0001-Resolves-rhbz-1647507-try-inputted-password-as-both-.patch
@ -1,40 +0,0 @@
 From f648553dfc356b3c5e6dd77ea96039a9977f00d6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 8 Nov 2018 10:58:00 +0000
 Subject: [PATCH] Resolves: rhbz#1647507 try inputted password as both user and
 owner password
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: Ibe1fae39d3153238e85400c9645766c260c9290d
 Reviewed-on: https://gerrit.libreoffice.org/63080
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit e3ca8385fed93e61efb8200149e06b822a84a47e)
 ---
 sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx b/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
 index 16db05afe870..b536a710e832 100644
 --- a/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
 +++ b/sdext/source/pdfimport/xpdfwrapper/wrapper_gpl.cxx
@@ -101,9 +101,11 @@ int main(int argc, char **argv)
                                  : (ownerPassword[0] != '\001'
                                     ? new GooString(ownerPassword)
                                     : nullptr ) );
 -    GooString* pUserPasswordStr(  userPassword[0] != '\001'
 +    GooString* pUserPasswordStr( aPwBuf[0] != 0
 +                                ? new GooString( aPwBuf )
 +                                : (userPassword[0] != '\001'
                                   ? new GooString(userPassword)
 -                                  : nullptr );
 +                                  : nullptr ) );
     if( outputFile[0] != '\001' )
         g_binary_out = fopen(outputFile,"wb");
 -- 
 2.17.1
--- a/SOURCES/0001-Resolves-rhbz-1715109-add-All-files-to-the-graphic-i.patch
+++ b/SOURCES/0001-Resolves-rhbz-1715109-add-All-files-to-the-graphic-i.patch
@ -1,57 +0,0 @@
 From bcb05a5daba9aafdc3921322676f33e055413f9f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 31 May 2019 15:33:00 +0100
 Subject: [PATCH] Resolves: rhbz#1715109 add All files to the graphic import
 dialog
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 to pick up things without extensions, for consistency with file->open
 Reviewed-on: https://gerrit.libreoffice.org/73276
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit c6c14f6ae7f6d7768b450e7776db917bb662f3cf)
 Change-Id: Ib119fb0d053d1d288eee7cd17fa4f12dcb9956d7
 ---
 sfx2/source/dialog/filedlghelper.cxx | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)
 diff --git a/sfx2/source/dialog/filedlghelper.cxx b/sfx2/source/dialog/filedlghelper.cxx
 index 3820ee4107c9..737dcb278a2a 100644
 --- a/sfx2/source/dialog/filedlghelper.cxx
 +++ b/sfx2/source/dialog/filedlghelper.cxx
@@ -1872,11 +1872,23 @@ void FileDialogHelper_Impl::addGraphicFilter()
     try
     {
 -        OUString aAllFilterName = SfxResId( STR_SFX_IMPORT_ALL );
 -        aAllFilterName = ::sfx2::addExtension( aAllFilterName, aExtensions, bIsInOpenMode, *this );
 +        // if the extension is not "All files", insert "All images"
 +        if (aExtensions != FILEDIALOG_FILTER_ALL)
 +        {
 +            OUString aAllFilterName = SfxResId(STR_SFX_IMPORT_ALL);
 +            aAllFilterName = ::sfx2::addExtension( aAllFilterName, aExtensions, bIsInOpenMode, *this );
 +            xFltMgr->appendFilter( aAllFilterName, aExtensions );
 +            maSelectFilter = aAllFilterName; // and make it the default
 +        }
 +
 +        // rhbz#1715109 always include All files *.* or *
 +        OUString aAllFilesName = SfxResId( STR_SFX_FILTERNAME_ALL );
 +        aAllFilesName = ::sfx2::addExtension( aAllFilesName, FILEDIALOG_FILTER_ALL, bIsInOpenMode, *this );
 +        xFltMgr->appendFilter( aAllFilesName, FILEDIALOG_FILTER_ALL );
 -        xFltMgr->appendFilter( aAllFilterName, aExtensions );
 -        maSelectFilter = aAllFilterName;
 +        // if the extension is "All files", make that the default
 +        if (aExtensions == FILEDIALOG_FILTER_ALL)
 +            maSelectFilter = aAllFilesName;
     }
     catch( const IllegalArgumentException& )
     {
 -- 
 2.21.0
--- a/SOURCES/0001-Resolves-rhbz-1893846-if-last-close-had-insert-index.patch
+++ b/SOURCES/0001-Resolves-rhbz-1893846-if-last-close-had-insert-index.patch
@ -0,0 +1,30 @@
 From d59960d5de3f07726594d980152a3bfeb58bace9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 2 Nov 2020 19:27:04 +0000
 Subject: [PATCH 1/8] Resolves: rhbz#1893846 if last close had insert, index
 dialog open
 when starting a new writer document
 Change-Id: I83131c01aa53208a321abade48d48a6f7965d0ff
 ---
 sw/source/ui/index/swuiidxmrk.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/sw/source/ui/index/swuiidxmrk.cxx b/sw/source/ui/index/swuiidxmrk.cxx
 index 33a0eab8cd69..5eca069b963b 100644
 --- a/sw/source/ui/index/swuiidxmrk.cxx
 +++ b/sw/source/ui/index/swuiidxmrk.cxx
@@ -955,7 +955,8 @@ SwIndexMarkFloatDlg::SwIndexMarkFloatDlg(SfxBindings* _pBindings,
         "modules/swriter/ui/indexentry.ui", "IndexEntryDialog")
     , m_aContent(m_xDialog, *m_xBuilder, bNew, *::GetActiveWrtShell())
 {
 -    m_aContent.ReInitDlg(*::GetActiveWrtShell());
 +    if (SwWrtShell* pSh = ::GetActiveWrtShell())
 +        m_aContent.ReInitDlg(*pSh);
     Initialize(pInfo);
 }
 -- 
 2.28.0
--- a/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
+++ b/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
@ -0,0 +1,72 @@
 From 5c705fbd9e4d231fed87b7e8ac06d8b7d4c6891f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 12 Aug 2021 12:55:30 +0100
 Subject: [PATCH] Resolves: tdf#132739 two style tags where there should be
 just one
 Change-Id: Id9c8c8cc8c5ffdd21ba79ff39a6279cf2ddc8025
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120360
 Tested-by: Jenkins
 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
 ---
 sw/source/filter/html/css1atr.cxx  | 4 +++-
 sw/source/filter/html/htmltabw.cxx | 9 ++++++---
 sw/source/filter/html/wrthtml.hxx  | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)
 diff --git a/sw/source/filter/html/css1atr.cxx b/sw/source/filter/html/css1atr.cxx
 index 7b1a5cc19be3..c401d95a788f 100644
 --- a/sw/source/filter/html/css1atr.cxx
 +++ b/sw/source/filter/html/css1atr.cxx
@@ -2113,10 +2113,12 @@ void SwHTMLWriter::OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameF
         Strm().WriteChar( '\"' );
 }
 -void SwHTMLWriter::OutCSS1_TableCellBorderHack(SwFrameFormat const& rFrameFormat)
 +void SwHTMLWriter::OutCSS1_TableCellBordersAndBG(SwFrameFormat const& rFrameFormat, const SvxBrushItem *pBrushItem)
 {
     SwCSS1OutMode const aMode( *this,
         CSS1_OUTMODE_STYLE_OPT_ON|CSS1_OUTMODE_ENCODE|CSS1_OUTMODE_TABLEBOX, nullptr );
 +    if (pBrushItem)
 +        OutCSS1_SvxBrush(*this, *pBrushItem, Css1Background::Table, nullptr);
     OutCSS1_SvxBox(*this, rFrameFormat.GetBox());
     if (!m_bFirstCSS1Property)
     {
 diff --git a/sw/source/filter/html/htmltabw.cxx b/sw/source/filter/html/htmltabw.cxx
 index 4c83319747b7..63812a9b3ef6 100644
 --- a/sw/source/filter/html/htmltabw.cxx
 +++ b/sw/source/filter/html/htmltabw.cxx
@@ -424,11 +424,14 @@ void SwHTMLWrtTable::OutTableCell( SwHTMLWriter& rWrt,
             // Avoid non-CSS version in the ReqIF case.
             rWrt.OutBackground( pBrushItem, false );
 -        if( rWrt.m_bCfgOutStyles )
 -            OutCSS1_TableBGStyleOpt( rWrt, *pBrushItem );
 +        if (!rWrt.m_bCfgOutStyles)
 +            pBrushItem = nullptr;
     }
 -    rWrt.OutCSS1_TableCellBorderHack(*pBox->GetFrameFormat());
 +    // tdf#132739 with rWrt.m_bCfgOutStyles of true bundle the brush item css
 +    // properties into the same "style" tag as the borders so there is only one
 +    // style tag
 +    rWrt.OutCSS1_TableCellBordersAndBG(*pBox->GetFrameFormat(), pBrushItem);
     sal_uInt32 nNumFormat = 0;
     double nValue = 0.0;
 diff --git a/sw/source/filter/html/wrthtml.hxx b/sw/source/filter/html/wrthtml.hxx
 index ab282ba652ff..f82325ee50ae 100644
 --- a/sw/source/filter/html/wrthtml.hxx
 +++ b/sw/source/filter/html/wrthtml.hxx
@@ -484,7 +484,7 @@ public:
     void writeFrameFormatOptions(HtmlWriter& aHtml, const SwFrameFormat& rFrameFormat, const OUString& rAltText, HtmlFrmOpts nFrameOpts);
     void OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameFormat );
 -    void OutCSS1_TableCellBorderHack(const SwFrameFormat& rFrameFormat);
 +    void OutCSS1_TableCellBordersAndBG(const SwFrameFormat& rFrameFormat, const SvxBrushItem *pBrushItem);
     void OutCSS1_SectionFormatOptions( const SwFrameFormat& rFrameFormat, const SwFormatCol *pCol );
     void OutCSS1_FrameFormatOptions( const SwFrameFormat& rFrameFormat, HtmlFrmOpts nFrameOpts,
                                      const SdrObject *pSdrObj=nullptr,
 -- 
 2.31.1
--- a/SOURCES/0001-Restructure-solenv-bin-assemble-flatpak.sh.patch
+++ b/SOURCES/0001-Restructure-solenv-bin-assemble-flatpak.sh.patch
@ -0,0 +1,340 @@
 From 54f42e1b75dd795f9d53dce181397f114eeae21b Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Tue, 28 Apr 2020 16:43:31 +0200
 Subject: [PATCH] Restructure solenv/bin/assemble-flatpak.sh
 ...so that parts of it can be reused by the Flatpak build done from Fedora RPMs
 (see <https://src.fedoraproject.org/flatpaks/libreoffice>).  The reused parts
 are split out into solenv/bin/assemble-flatpak-*.sh files.
 (I can't remember any specific reason why I added the <releases> section to the
 Flathub org.libreoffice.LibreOffice.appdata.xml; maybe just because the file
 format allows for it and it appeared easy to generate the section when writing
 the file.  For the Fedora LO RPMs, none of the existing appdata.xml files
 contained such a section, and generating one for the Fedora Flatpak case would
 require obtaining values for those LIBO_VERSION_* variables, so I just added a
 switch to solenv/bin/assemble-flatpak-appdata-step1.sh allowing not to write
 that section at all.  Splitting solenv/bin/assemble-flatpak-appdata.sh in two
 steps is necessary because the Fedora Flatpak case wants to replace the
 screenshots in the first part of the generated
 org.libreoffice.LibreOffice.appdata.xml, but not in the appended original
 appdata.xml files, so needs to hook in between those two steps.)
 Change-Id: Ic527f3d88ccbee85e86dad3569b8e73776adf273
 ---
 solenv/bin/assemble-flatpak-appdata-step1.sh |  96 +++++++++++++++++
 solenv/bin/assemble-flatpak-appdata-step2.sh |  26 +++++
 solenv/bin/assemble-flatpak-desktop.sh       |  42 ++++++++
 solenv/bin/assemble-flatpak.sh               | 102 +------------------
 4 files changed, 169 insertions(+), 97 deletions(-)
 create mode 100755 solenv/bin/assemble-flatpak-appdata-step1.sh
 create mode 100755 solenv/bin/assemble-flatpak-appdata-step2.sh
 create mode 100755 solenv/bin/assemble-flatpak-desktop.sh
 diff --git a/solenv/bin/assemble-flatpak-appdata-step1.sh b/solenv/bin/assemble-flatpak-appdata-step1.sh
 new file mode 100755
 index 000000000000..4658dd45d018
 --- /dev/null
 +++ b/solenv/bin/assemble-flatpak-appdata-step1.sh
@@ -0,0 +1,96 @@
 +#! /bin/bash
 +#
 +# This file is part of the LibreOffice project.
 +#
 +# This Source Code Form is subject to the terms of the Mozilla Public
 +# License, v. 2.0. If a copy of the MPL was not distributed with this
 +# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 +#
 +
 +# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
 +# Flatpak from a Fedora libreoffice.spec file.
 +#
 +# Arguments:
 +# $1  pathname, ending in a slash, of the directory into which to put the target
 +#     org.libreoffice.LibreOffice.appdata.xml file
 +# $2  "1" if a <releases> section shall be included in the target
 +#     org.libreoffice.LibreOffice.appdata.xml file, "0" if not
 +
 +set -e
 +
 +## org.libreoffice.LibreOffice.appdata.xml is manually derived from the various
 +## inst/share/appdata/libreoffice-*.appdata.xml (at least recent GNOME Software
 +## doesn't show more than five screenshots anyway, so restrict to one each from
 +## the five libreoffice-*.appdata.xml: Writer, Calc, Impress, Draw, Base):
 +cat <<\EOF >"${1?}"org.libreoffice.LibreOffice.appdata.xml
 +<?xml version="1.0" encoding="UTF-8"?>
 +<component type="desktop">
 + <id>org.libreoffice.LibreOffice.desktop</id>
 + <metadata_license>CC0-1.0</metadata_license>
 + <project_license>MPL-2.0</project_license>
 + <name>LibreOffice</name>
 + <summary>The LibreOffice productivity suite</summary>
 + <description>
 +  <p>LibreOffice is a powerful office suite.  Its clean interface and
 +  feature-rich tools help you unleash your creativity and enhance your
 +  productivity.  LibreOffice includes several applications that make it the most
 +  powerful Free and Open Source office suite on the market: Writer (word
 +  processing), Calc (spreadsheets), Impress (presentations), Draw (vector
 +  graphics and flowcharts), Base (databases), and Math (formula editing).</p>
 +  <p>LibreOffice supports opening and saving into a wide variety of formats, so
 +  you can easily share documents with users of other popular office suites
 +  without worrying about compatibility.</p>
 + </description>
 + <url type="homepage">http://www.libreoffice.org/discover/libreoffice/</url>
 + <url type="bugtracker">https://bugs.documentfoundation.org/</url>
 + <url type="donation">https://donate.libreoffice.org/</url>
 + <url type="faq">https://wiki.documentfoundation.org/Faq</url>
 + <url type="help">http://www.libreoffice.org/get-help/documentation/</url>
 + <url type="translate">https://wiki.documentfoundation.org/Translating_LibreOffice</url>
 + <screenshots>
 +  <screenshot type="default">
 +   <image>https://hub.libreoffice.org/screenshots/writer-01.png</image>
 +   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 +  </screenshot>
 +  <screenshot>
 +   <image>https://hub.libreoffice.org/screenshots/calc-02.png</image>
 +   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 +  </screenshot>
 +  <screenshot>
 +   <image>https://hub.libreoffice.org/screenshots/impress-01.png</image>
 +   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 +  </screenshot>
 +  <screenshot>
 +   <image>https://hub.libreoffice.org/screenshots/draw-02.png</image>
 +   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 +  </screenshot>
 +  <screenshot>
 +   <image>https://hub.libreoffice.org/screenshots/base-02.png</image>
 +   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 +  </screenshot>
 + </screenshots>
 + <developer_name>The Document Foundation</developer_name>
 + <update_contact>libreoffice_at_lists.freedesktop.org</update_contact>
 + <kudos>
 +  <kudo>HiDpiIcon</kudo>
 +  <kudo>HighContrast</kudo>
 +  <kudo>ModernToolkit</kudo>
 +  <kudo>UserDocs</kudo>
 + </kudos>
 + <content_rating type="oars-1.0"/>
 +EOF
 +
 +if [ "${2?}" = 1 ]
 +then
 + cat <<EOF >>"${1?}"org.libreoffice.LibreOffice.appdata.xml
 + <releases>
 +  <release
 +    version="${LIBO_VERSION_MAJOR?}.${LIBO_VERSION_MINOR?}.${LIBO_VERSION_MICRO?}.${LIBO_VERSION_PATCH?}"
 +    date="$(date +%Y-%m-%d)"/>
 + </releases>
 +EOF
 +fi
 +
 +cat <<\EOF >>"${1?}"org.libreoffice.LibreOffice.appdata.xml
 +</component>
 +EOF
 diff --git a/solenv/bin/assemble-flatpak-appdata-step2.sh b/solenv/bin/assemble-flatpak-appdata-step2.sh
 new file mode 100755
 index 000000000000..4f06e6b19148
 --- /dev/null
 +++ b/solenv/bin/assemble-flatpak-appdata-step2.sh
@@ -0,0 +1,26 @@
 +#! /bin/bash
 +#
 +# This file is part of the LibreOffice project.
 +#
 +# This Source Code Form is subject to the terms of the Mozilla Public
 +# License, v. 2.0. If a copy of the MPL was not distributed with this
 +# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 +#
 +
 +# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
 +# Flatpak from a Fedora libreoffice.spec file.
 +#
 +# Arguments:
 +# $1  pathname, ending in a slash, of the directory containing the source libreoffice-*.appdata.xml
 +#     files
 +# $2  pathname, ending in a slash, of the directory containing the target
 +#     org.libreoffice.LibreOffice.appdata.xml file
 +
 +set -e
 +
 +# append the appdata for the different components
 +for i in "${1?}"libreoffice-*.appdata.xml
 +do
 +  sed "1 d; s/<id>libreoffice-/<id>org.libreoffice.LibreOffice./" "$i" \
 +    >>"${2?}"org.libreoffice.LibreOffice.appdata.xml
 +done
 diff --git a/solenv/bin/assemble-flatpak-desktop.sh b/solenv/bin/assemble-flatpak-desktop.sh
 new file mode 100755
 index 000000000000..6d06de4fbbbe
 --- /dev/null
 +++ b/solenv/bin/assemble-flatpak-desktop.sh
@@ -0,0 +1,42 @@
 +#! /bin/bash
 +#
 +# This file is part of the LibreOffice project.
 +#
 +# This Source Code Form is subject to the terms of the Mozilla Public
 +# License, v. 2.0. If a copy of the MPL was not distributed with this
 +# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 +#
 +
 +# Part of solenv/bin/assemble-flatpak.sh that is shared with a downstream mechanism of building a
 +# Flatpak from a Fedora libreoffice.spec file.
 +#
 +# Arguments:
 +# $1  pathname, ending in a slash, of the directory containing the source libreoffice-*.desktop
 +#     files
 +# $2  pathname, ending in a slash, of the directory into which to put the target
 +#     org.libreoffice.LibreOffice.*.desktop files
 +
 +set -e
 +
 +## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
 +for i in "${1?}"libreoffice-*.desktop
 +do
 + sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
 +  >"${2?}"org.libreoffice.LibreOffice."${i#"${1?}"libreoffice-}"
 +done
 +mv "${2?}"org.libreoffice.LibreOffice.startcenter.desktop "${2?}"org.libreoffice.LibreOffice.desktop
 +
 +# Flatpak .desktop exports take precedence over system ones due to
 +# the order of XDG_DATA_DIRS - re-associating text/plain seems a bit much
 +sed -i "s/text\/plain;//" "${2?}"org.libreoffice.LibreOffice.writer.desktop
 +
 +desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-startcenter \
 + --set-key=X-Flatpak-RenamedFrom --set-value='libreoffice-startcenter.desktop;' \
 + "${2?}"org.libreoffice.LibreOffice.desktop
 +for i in base calc draw impress math writer xsltfilter
 +do
 + desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-"$i" \
 +  --set-key=X-Flatpak-RenamedFrom \
 +  --set-value="libreoffice-$i.desktop;org.libreoffice.LibreOffice-$i.desktop;" \
 +  "${2?}"org.libreoffice.LibreOffice."$i".desktop
 +done
 diff --git a/solenv/bin/assemble-flatpak.sh b/solenv/bin/assemble-flatpak.sh
 index 0738fcd59ad2..8ca5bcf08c41 100755
 --- a/solenv/bin/assemble-flatpak.sh
 +++ b/solenv/bin/assemble-flatpak.sh
@@ -16,30 +16,9 @@ set -e
 cp -r "${PREFIXDIR?}"/lib/libreoffice /app/
 ln -s /app/libreoffice/program/soffice /app/bin/libreoffice
 -## libreoffice-*.desktop -> org.libreoffice.LibreOffice.*.desktop:
 mkdir -p /app/share/applications
 -for i in "${PREFIXDIR?}"/share/applications/libreoffice-*.desktop
 -do
 - sed -e 's/^Icon=libreoffice-/Icon=org.libreoffice.LibreOffice./' "$i" \
 -  >/app/share/applications/org.libreoffice.LibreOffice."${i#"${PREFIXDIR?}"/share/applications/libreoffice-}"
 -done
 -mv /app/share/applications/org.libreoffice.LibreOffice.startcenter.desktop \
 - /app/share/applications/org.libreoffice.LibreOffice.desktop
 -
 -# Flatpak .desktop exports take precedence over system ones due to
 -# the order of XDG_DATA_DIRS - re-associating text/plain seems a bit much
 -sed -i "s/text\/plain;//" /app/share/applications/org.libreoffice.LibreOffice.writer.desktop
 -
 -desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-startcenter \
 - --set-key=X-Flatpak-RenamedFrom --set-value='libreoffice-startcenter.desktop;' \
 - /app/share/applications/org.libreoffice.LibreOffice.desktop
 -for i in base calc draw impress math writer xsltfilter
 -do
 - desktop-file-edit --set-key=X-Endless-Alias --set-value=libreoffice-"$i" \
 -  --set-key=X-Flatpak-RenamedFrom \
 -  --set-value="libreoffice-$i.desktop;org.libreoffice.LibreOffice-$i.desktop;" \
 -  /app/share/applications/org.libreoffice.LibreOffice."$i".desktop
 -done
 +"${SRCDIR?}"/solenv/bin/assemble-flatpak-desktop.sh "${PREFIXDIR?}"/share/applications/ \
 + /app/share/applications/
 ## icons/hicolor/*/apps/libreoffice-* ->
 ## icons/hicolor/*/apps/org.libreoffice.LibreOffice-*:
@@ -82,81 +61,10 @@ do
   ln -rs /app/share/runtime/locale/"${lang}"/registry/"${basename}".xcd "${i}"
 done
 -## org.libreoffice.LibreOffice.appdata.xml is manually derived from the various
 -## inst/share/appdata/libreoffice-*.appdata.xml (at least recent GNOME Software
 -## doesn't show more than five screenshots anyway, so restrict to one each from
 -## the five libreoffice-*.appdata.xml: Writer, Calc, Impress, Draw, Base):
 mkdir -p /app/share/appdata
 -cat <<EOF >/app/share/appdata/org.libreoffice.LibreOffice.appdata.xml
 -<?xml version="1.0" encoding="UTF-8"?>
 -<component type="desktop">
 - <id>org.libreoffice.LibreOffice.desktop</id>
 - <metadata_license>CC0-1.0</metadata_license>
 - <project_license>MPL-2.0</project_license>
 - <name>LibreOffice</name>
 - <summary>The LibreOffice productivity suite</summary>
 - <description>
 -  <p>LibreOffice is a powerful office suite.  Its clean interface and
 -  feature-rich tools help you unleash your creativity and enhance your
 -  productivity.  LibreOffice includes several applications that make it the most
 -  powerful Free and Open Source office suite on the market: Writer (word
 -  processing), Calc (spreadsheets), Impress (presentations), Draw (vector
 -  graphics and flowcharts), Base (databases), and Math (formula editing).</p>
 -  <p>LibreOffice supports opening and saving into a wide variety of formats, so
 -  you can easily share documents with users of other popular office suites
 -  without worrying about compatibility.</p>
 - </description>
 - <url type="homepage">http://www.libreoffice.org/discover/libreoffice/</url>
 - <url type="bugtracker">https://bugs.documentfoundation.org/</url>
 - <url type="donation">https://donate.libreoffice.org/</url>
 - <url type="faq">https://wiki.documentfoundation.org/Faq</url>
 - <url type="help">http://www.libreoffice.org/get-help/documentation/</url>
 - <url type="translate">https://wiki.documentfoundation.org/Translating_LibreOffice</url>
 - <screenshots>
 -  <screenshot type="default">
 -   <image>https://hub.libreoffice.org/screenshots/writer-01.png</image>
 -   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 -  </screenshot>
 -  <screenshot>
 -   <image>https://hub.libreoffice.org/screenshots/calc-02.png</image>
 -   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 -  </screenshot>
 -  <screenshot>
 -   <image>https://hub.libreoffice.org/screenshots/impress-01.png</image>
 -   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 -  </screenshot>
 -  <screenshot>
 -   <image>https://hub.libreoffice.org/screenshots/draw-02.png</image>
 -   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 -  </screenshot>
 -  <screenshot>
 -   <image>https://hub.libreoffice.org/screenshots/base-02.png</image>
 -   <caption><!-- Describe this screenshot in less than ~10 words --></caption>
 -  </screenshot>
 - </screenshots>
 - <developer_name>The Document Foundation</developer_name>
 - <update_contact>libreoffice_at_lists.freedesktop.org</update_contact>
 - <kudos>
 -  <kudo>HiDpiIcon</kudo>
 -  <kudo>HighContrast</kudo>
 -  <kudo>ModernToolkit</kudo>
 -  <kudo>UserDocs</kudo>
 - </kudos>
 - <content_rating type="oars-1.0"/>
 - <releases>
 -  <release
 -    version="${LIBO_VERSION_MAJOR?}.${LIBO_VERSION_MINOR?}.${LIBO_VERSION_MICRO?}.${LIBO_VERSION_PATCH?}"
 -    date="$(date +%Y-%m-%d)"/>
 - </releases>
 -</component>
 -EOF
 -
 -# append the appdata for the different components
 -for i in "${PREFIXDIR?}"/share/appdata/libreoffice-*.appdata.xml
 -do
 -  sed "1 d; s/<id>libreoffice-/<id>org.libreoffice.LibreOffice./" "$i" \
 -    >>/app/share/appdata/org.libreoffice.LibreOffice.appdata.xml
 -done
 +"${SRCDIR?}"/solenv/bin/assemble-flatpak-appdata-step1.sh /app/share/appdata/ 1
 +"${SRCDIR?}"/solenv/bin/assemble-flatpak-appdata-step2.sh "${PREFIXDIR?}"/share/appdata/ \
 + /app/share/appdata/
 ## see <https://github.com/flatpak/flatpak/blob/master/app/
 ## flatpak-builtins-build-finish.c> for further places where build-finish would
 -- 
 2.26.2
--- a/SOURCES/0001-Revert-tdf-69060-lock-refreshing-font-data-when-load.patch
+++ b/SOURCES/0001-Revert-tdf-69060-lock-refreshing-font-data-when-load.patch
@ -0,0 +1,150 @@
 From d7ed56975a828eac321959e4510ee14560847b1f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 28 Oct 2020 14:25:11 +0000
 Subject: [PATCH] Revert "tdf#69060: lock refreshing font data when loading a
 document"
 This reverts commit 98d71c4e0847797a4ba9229a8e6d832a8a3d5e0f.
 ---
 include/vcl/outdev.hxx      |  3 ---
 include/vcl/svapp.hxx       | 11 -----------
 sfx2/source/doc/objstor.cxx |  4 ----
 vcl/inc/svdata.hxx          |  3 ---
 vcl/source/app/svapp.cxx    |  5 -----
 vcl/source/outdev/font.cxx  | 32 +-------------------------------
 6 files changed, 1 insertion(+), 57 deletions(-)
 diff --git a/include/vcl/outdev.hxx b/include/vcl/outdev.hxx
 index cd3c84d13305..55b466b42464 100644
 --- a/include/vcl/outdev.hxx
 +++ b/include/vcl/outdev.hxx
@@ -1278,9 +1278,6 @@ public:
     //If bNewFontLists is true then drop and refetch lists of system fonts
     SAL_DLLPRIVATE static void  ImplUpdateAllFontData( bool bNewFontLists );
 -    // Lock font updates for all output devices
 -    static void LockFontUpdates(bool bLock);
 -
 protected:
     SAL_DLLPRIVATE const LogicalFontInstance* GetFontInstance() const;
     SAL_DLLPRIVATE long GetEmphasisAscent() const { return mnEmphasisAscent; }
 diff --git a/include/vcl/svapp.hxx b/include/vcl/svapp.hxx
 index 16b8015b923a..4f7b9d6def31 100644
 --- a/include/vcl/svapp.hxx
 +++ b/include/vcl/svapp.hxx
@@ -1326,17 +1326,6 @@ public:
     ///@}
 -    /** Lock font updates for all output devices
 -
 -     @remark When performing operations that might involve multiple registration of fonts, such as
 -        opening/closing documents with multiple embedded fonts, then each font addition/removal
 -        might cause an event that initiates a rebuild of each OutputDevice's font lists.
 -
 -        Locking font updates disables processing such events, and unlocking causes a single such
 -        processing for all OutputDevices.
 -    */
 -    static void LockFontUpdates(bool bLock);
 -
     // For vclbootstrapprotector:
     static void setDeInitHook(Link<LinkParamNone*,void> const & hook);
 diff --git a/sfx2/source/doc/objstor.cxx b/sfx2/source/doc/objstor.cxx
 index 6d7b3f99ee69..ac9f4242a1bc 100644
 --- a/sfx2/source/doc/objstor.cxx
 +++ b/sfx2/source/doc/objstor.cxx
@@ -582,10 +582,6 @@ bool SfxObjectShell::ImportFromGeneratedStream_Impl(
 bool SfxObjectShell::DoLoad( SfxMedium *pMed )
 {
     ModifyBlocker_Impl aBlock( this );
 -    struct FontLockGuard {
 -        FontLockGuard() { Application::LockFontUpdates(true); }
 -        ~FontLockGuard() { Application::LockFontUpdates(false); }
 -    } aFontLockGuard;
     pMedium = pMed;
     pMedium->CanDisposeStorage_Impl( true );
 diff --git a/vcl/inc/svdata.hxx b/vcl/inc/svdata.hxx
 index e41ec23488b3..dc10f3102ede 100644
 --- a/vcl/inc/svdata.hxx
 +++ b/vcl/inc/svdata.hxx
@@ -338,9 +338,6 @@ struct ImplSVData
     VclPtr<WorkWindow>      mpDefaultWin;                   // Default-Window
     bool                    mbDeInit = false;               // Is VCL deinitializing
     std::unique_ptr<SalSystem> mpSalSystem;                 // SalSystem interface
 -    int                     mnFontUpdatesLockCount = 0;     // avoid repeated font updates
 -    bool                    mbFontUpdatesPending = false;   // need to update font data after unlock
 -    bool                    mbFontUpdatesNewLists = false;  // generate new font lists
     bool                    mbResLocaleSet = false;         // SV-Resource-Manager
     std::locale             maResLocale;                    // Resource locale
     ImplSchedulerContext    maSchedCtx;                     // indepen data for class Scheduler
 diff --git a/vcl/source/app/svapp.cxx b/vcl/source/app/svapp.cxx
 index c4c3be9699e3..de4eac9687fc 100644
 --- a/vcl/source/app/svapp.cxx
 +++ b/vcl/source/app/svapp.cxx
@@ -1036,11 +1036,6 @@ void Application::RemoveUserEvent( ImplSVEvent * nUserEvent )
     }
 }
 -void Application::LockFontUpdates(bool bLock)
 -{
 -    OutputDevice::LockFontUpdates(bLock);
 -}
 -
 WorkWindow* Application::GetAppWindow()
 {
     return ImplGetSVData()->maWinData.mpAppWin;
 diff --git a/vcl/source/outdev/font.cxx b/vcl/source/outdev/font.cxx
 index 22c61063bd21..e1fd7d107e63 100644
 --- a/vcl/source/outdev/font.cxx
 +++ b/vcl/source/outdev/font.cxx
@@ -559,16 +559,7 @@ void OutputDevice::ImplClearAllFontData(bool bNewFontLists)
 void OutputDevice::ImplRefreshAllFontData(bool bNewFontLists)
 {
 -    auto svdata = ImplGetSVData();
 -    DBG_TESTSOLARMUTEX();
 -    if (!svdata->mnFontUpdatesLockCount)
 -        ImplUpdateFontDataForAllFrames(&OutputDevice::ImplRefreshFontData, bNewFontLists);
 -    else
 -    {
 -        svdata->mbFontUpdatesPending = true;
 -        if (bNewFontLists)
 -            svdata->mbFontUpdatesNewLists = true;
 -    }
 +    ImplUpdateFontDataForAllFrames( &OutputDevice::ImplRefreshFontData, bNewFontLists );
 }
 void OutputDevice::ImplUpdateAllFontData(bool bNewFontLists)
@@ -614,27 +605,6 @@ void OutputDevice::ImplUpdateFontDataForAllFrames( const FontUpdateHandler_t pHd
     }
 }
 -void OutputDevice::LockFontUpdates(bool bLock)
 -{
 -    auto svdata = ImplGetSVData();
 -    DBG_TESTSOLARMUTEX();
 -    if (bLock)
 -    {
 -        ++svdata->mnFontUpdatesLockCount;
 -    }
 -    else if (svdata->mnFontUpdatesLockCount > 0)
 -    {
 -        --svdata->mnFontUpdatesLockCount;
 -        if (!svdata->mnFontUpdatesLockCount && svdata->mbFontUpdatesPending)
 -        {
 -            ImplRefreshAllFontData(svdata->mbFontUpdatesNewLists);
 -
 -            svdata->mbFontUpdatesPending = false;
 -            svdata->mbFontUpdatesNewLists = false;
 -        }
 -    }
 -}
 -
 void OutputDevice::BeginFontSubstitution()
 {
     ImplSVData* pSVData = ImplGetSVData();
 -- 
 2.26.2
--- a/SOURCES/0001-Upgrade-to-ICU-61.1.patch
+++ b/SOURCES/0001-Upgrade-to-ICU-61.1.patch
@ -1,675 +0,0 @@
 From f247f08e370626bbb427acd8f4a400fd875350a3 Mon Sep 17 00:00:00 2001
 Message-Id: <f247f08e370626bbb427acd8f4a400fd875350a3.1531842113.git.erack@redhat.com>
 From: Eike Rathke <erack@redhat.com>
 Date: Tue, 17 Apr 2018 20:13:52 +0200
 Subject: [PATCH] Upgrade to ICU 61.1
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: I89c1c3d13d85decc72576744de2a16d20471d29d
 Reviewed-on: https://gerrit.libreoffice.org/53064
 Tested-by: Jenkins <ci@libreoffice.org>
 Reviewed-by: Eike Rathke <erack@redhat.com>
 ---
 configure.ac                                  |   4 +-
 download.lst                                  |   8 +-
 external/icu/UnpackedTarball_icu.mk           |   3 +-
 ...patch.1 => icu4c-61-werror-shadow.patch.1} |  30 ++-
 external/icu/icu4c-khmerbreakengine.patch.1   | 246 +++++++++---------
 external/icu/icu4c-ubsan.patch.1              |  91 -------
 6 files changed, 147 insertions(+), 235 deletions(-)
 rename external/icu/{icu4c-59-werror-shadow.patch.1 => icu4c-61-werror-shadow.patch.1} (50%)
 delete mode 100644 external/icu/icu4c-ubsan.patch.1
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-Upgrade-to-ICU-61.1.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-Upgrade-to-ICU-61.1.patch"
 diff --git a/configure.ac b/configure.ac
 index bdc374699cb9..458f9f3c2735 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -9001,8 +9001,8 @@ SYSTEM_GENBRK=
 SYSTEM_GENCCODE=
 SYSTEM_GENCMN=
 -ICU_MAJOR=60
 -ICU_MINOR=2
 +ICU_MAJOR=61
 +ICU_MINOR=1
 ICU_RECLASSIFIED_PREPEND_SET_EMPTY="TRUE"
 ICU_RECLASSIFIED_CONDITIONAL_JAPANESE_STARTER="TRUE"
 ICU_RECLASSIFIED_HEBREW_LETTER="TRUE"
 diff --git a/download.lst b/download.lst
 index 0a1fa65396d1..76f067bff4d7 100644
 --- a/download.lst
 +++ b/download.lst
@@ -102,10 +102,10 @@ export HUNSPELL_SHA256SUM := 3cd9ceb062fe5814f668e4f22b2fa6e3ba0b339b921739541ce
 export HUNSPELL_TARBALL := hunspell-1.6.2.tar.gz
 export HYPHEN_SHA256SUM := 304636d4eccd81a14b6914d07b84c79ebb815288c76fe027b9ebff6ff24d5705
 export HYPHEN_TARBALL := 5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz
 -export ICU_SHA256SUM := f073ea8f35b926d70bb33e6577508aa642a8b316a803f11be20af384811db418
 -export ICU_TARBALL := icu4c-60_2-src.tgz
 -export ICU_DATA_SHA256SUM := 68f42ad0c9e0a5a5af8eba0577ba100833912288bad6e4d1f42ff480bbcfd4a9
 -export ICU_DATA_TARBALL := icu4c-60_2-data.zip
 +export ICU_SHA256SUM := d007f89ae8a2543a53525c74359b65b36412fa84b3349f1400be6dcf409fafef
 +export ICU_TARBALL := icu4c-61_1-src.tgz
 +export ICU_DATA_SHA256SUM := d149ed0985b5a6e16a9d8ed66f105dd58fd334c276779f74241cfa656ed2830a
 +export ICU_DATA_TARBALL := icu4c-61_1-data.zip
 export JFREEREPORT_FLOW_ENGINE_SHA256SUM := 233f66e8d25c5dd971716d4200203a612a407649686ef3b52075d04b4c9df0dd
 export JFREEREPORT_FLOW_ENGINE_TARBALL := ba2930200c9f019c2d93a8c88c651a0f-flow-engine-0.9.4.zip
 export JFREEREPORT_FLUTE_SHA256SUM := 1b5b24f7bc543c0362b667692f78db8bab4ed6dafc6172f104d0bd3757d8a133
 diff --git a/external/icu/UnpackedTarball_icu.mk b/external/icu/UnpackedTarball_icu.mk
 index a4d0b16ecb36..b81cdaab6242 100644
 --- a/external/icu/UnpackedTarball_icu.mk
 +++ b/external/icu/UnpackedTarball_icu.mk
@@ -27,15 +27,14 @@ $(eval $(call gb_UnpackedTarball_add_patches,icu,\
 	external/icu/icu4c-solarisgcc.patch.1 \
 	external/icu/icu4c-mkdir.patch.1 \
 	external/icu/icu4c-$(if $(filter ANDROID,$(OS)),android,rpath).patch.1 \
 -	external/icu/icu4c-ubsan.patch.1 \
 	external/icu/icu4c-icu11100.patch.1 \
 	external/icu/icu4c-scriptrun.patch.1 \
 	external/icu/icu4c-rtti.patch.1 \
 	external/icu/icu4c-clang-cl.patch.1 \
 	$(if $(filter-out ANDROID,$(OS)),external/icu/icu4c-icudata-stdlibs.patch.1) \
 	external/icu/icu4c-khmerbreakengine.patch.1 \
 -	external/icu/icu4c-59-werror-shadow.patch.1 \
 	external/icu/ofz4860.patch.2 \
 +	external/icu/icu4c-61-werror-shadow.patch.1 \
 ))
 $(eval $(call gb_UnpackedTarball_add_file,icu,source/data/brkitr/khmerdict.dict,external/icu/khmerdict.dict))
 diff --git a/external/icu/icu4c-59-werror-shadow.patch.1 b/external/icu/icu4c-61-werror-shadow.patch.1
 similarity index 50%
 rename from external/icu/icu4c-59-werror-shadow.patch.1
 rename to external/icu/icu4c-61-werror-shadow.patch.1
 index fb88244aff13..b00f76317eff 100644
 --- a/external/icu/icu4c-59-werror-shadow.patch.1
 +++ b/external/icu/icu4c-61-werror-shadow.patch.1
@@ -1,33 +1,35 @@
 +# https://ssl.icu-project.org/trac/ticket/13709
 +# Werror=shadow fails for unistr.h
 diff -ur icu.org/source/common/unicode/unistr.h icu/source/common/unicode/unistr.h
 ---- icu.org/source/common/unicode/unistr.h	2017-03-29 06:44:37.000000000 +0200
 -+++ icu/source/common/unicode/unistr.h	2017-04-24 11:59:51.782076511 +0200
 -@@ -3080,11 +3080,11 @@
 +--- icu.org/source/common/unicode/unistr.h	2018-03-26 15:38:29.000000000 +0200
 ++++ icu/source/common/unicode/unistr.h	2018-04-18 10:44:16.321188314 +0200
 +@@ -3053,11 +3053,11 @@
     * uint16_t * constructor.
     * Delegates to UnicodeString(const char16_t *, int32_t).
     * @param text UTF-16 string
 -   * @param length string length
 -+   * @param length_ string length
 -    * @draft ICU 59
 ++   * @param textLength string length
 +    * @stable ICU 59
     */
 -  UnicodeString(const uint16_t *text, int32_t length) :
 -      UnicodeString(ConstChar16Ptr(text), length) {}
 -+  UnicodeString(const uint16_t *text, int32_t length_) :
 -+      UnicodeString(ConstChar16Ptr(text), length_) {}
 ++  UnicodeString(const uint16_t *text, int32_t textLength) :
 ++      UnicodeString(ConstChar16Ptr(text), textLength) {}
  #endif
 -   /*
 -@@ -3097,11 +3097,11 @@
 + #if U_SIZEOF_WCHAR_T==2 || defined(U_IN_DOXYGEN)
 +@@ -3066,11 +3066,11 @@
     * (Only defined if U_SIZEOF_WCHAR_T==2.)
     * Delegates to UnicodeString(const char16_t *, int32_t).
     * @param text NUL-terminated UTF-16 string
 -   * @param length string length
 -+   * @param length_ string length
 -    * @draft ICU 59
 ++   * @param textLength string length
 +    * @stable ICU 59
     */
 -  UnicodeString(const wchar_t *text, int32_t length) :
 -      UnicodeString(ConstChar16Ptr(text), length) {}
 -+  UnicodeString(const wchar_t *text, int32_t length_) :
 -+      UnicodeString(ConstChar16Ptr(text), length_) {}
 ++  UnicodeString(const wchar_t *text, int32_t textLength) :
 ++      UnicodeString(ConstChar16Ptr(text), textLength) {}
  #endif
 -   /*
 +   /**
 diff --git a/external/icu/icu4c-khmerbreakengine.patch.1 b/external/icu/icu4c-khmerbreakengine.patch.1
 index 6b45b3743611..9f134dd961b1 100644
 --- a/external/icu/icu4c-khmerbreakengine.patch.1
 +++ b/external/icu/icu4c-khmerbreakengine.patch.1
@@ -1,16 +1,18 @@
 diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 ---- icu.org/source/common/dictbe.cpp	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/dictbe.cpp	2017-04-21 23:14:23.845894374 +0200
 -@@ -29,8 +29,17 @@
 +--- icu.org/source/common/dictbe.cpp	2018-03-26 15:38:30.000000000 +0200
 ++++ icu/source/common/dictbe.cpp	2018-04-17 17:55:38.620944919 +0200
 +@@ -29,7 +29,19 @@
   ******************************************************************
   */
 --DictionaryBreakEngine::DictionaryBreakEngine(uint32_t breakTypes) {
 -+DictionaryBreakEngine::DictionaryBreakEngine(uint32_t breakTypes) :
 -+    clusterLimit(3)
 -+{
 +-DictionaryBreakEngine::DictionaryBreakEngine() {
 ++DictionaryBreakEngine::DictionaryBreakEngine()
 ++    : fTypes(0), clusterLimit(0) {
 ++}
 ++
 ++DictionaryBreakEngine::DictionaryBreakEngine(uint32_t breakTypes)
 ++    : fTypes(breakTypes), clusterLimit(3) {
 +    UErrorCode status = U_ZERO_ERROR;
 -     fTypes = breakTypes;
 +    fViramaSet.applyPattern(UNICODE_STRING_SIMPLE("[[:ccc=VR:]]"), status);
 +
 +    // note Skip Sets contain fIgnoreSet characters too.
@@ -20,16 +22,7 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
  }
  DictionaryBreakEngine::~DictionaryBreakEngine() {
 -@@ -92,7 +101,7 @@
 -         result = divideUpDictionaryRange(text, rangeStart, rangeEnd, foundBreaks);
 -         utext_setNativeIndex(text, current);
 -     }
 --    
 -+
 -     return result;
 - }
 - 
 -@@ -103,6 +112,169 @@
 +@@ -76,6 +88,169 @@
      fSet.compact();
  }
@@ -199,7 +192,7 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
  /*
   ******************************************************************
   * PossibleWord
 -@@ -130,35 +302,35 @@
 +@@ -103,35 +278,35 @@
  public:
      PossibleWord() : count(0), prefix(0), offset(-1), mark(0), current(0) {};
      ~PossibleWord() {};
@@ -244,7 +237,7 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
          // Dictionary leaves text after longest prefix, not longest word. Back up.
          if (count <= 0) {
              utext_setNativeIndex(text, start);
 -@@ -830,51 +1002,28 @@
 +@@ -803,51 +978,28 @@
   * KhmerBreakEngine
   */
@@ -265,7 +258,8 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -static const int32_t KHMER_MIN_WORD_SPAN = KHMER_MIN_WORD * 2;
 -
  KhmerBreakEngine::KhmerBreakEngine(DictionaryMatcher *adoptDictionary, UErrorCode &status)
 -     : DictionaryBreakEngine((1 << UBRK_WORD) | (1 << UBRK_LINE)),
 +-    : DictionaryBreakEngine(),
 ++    : DictionaryBreakEngine((1 << UBRK_WORD) | (1 << UBRK_LINE)),
        fDictionary(adoptDictionary)
  {
 -    fKhmerWordSet.applyPattern(UNICODE_STRING_SIMPLE("[[:Khmr:]&[:LineBreak=SA:]]"), status);
@@ -301,13 +295,13 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -    fEndWordSet.compact();
 -    fBeginWordSet.compact();
 -//    fSuffixSet.compact();
 -+	fIgnoreSet.compact();
 -+	fBaseSet.compact();
 -+	fPuncSet.compact();
 ++    fIgnoreSet.compact();
 ++    fBaseSet.compact();
 ++    fPuncSet.compact();
  }
  KhmerBreakEngine::~KhmerBreakEngine() {
 -@@ -886,180 +1035,204 @@
 +@@ -859,180 +1011,204 @@
                                                  int32_t rangeStart,
                                                  int32_t rangeEnd,
                                                  UVector32 &foundBreaks ) const {
@@ -350,17 +344,6 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 +            foundBreaks.push(rangeEnd, status);
 +        return foundBreaks.size() - wordsFound;
 +    }
 -+
 -+    scanStart = rangeStart;
 -+    scanWJ(text, scanStart, rangeEnd, before, after);
 -+    if (startZwsp || initAfter >= before) {
 -+        after = initAfter;
 -+        before = 0;
 -+    }
 -+    if (!endZwsp && after > finalBefore && after < rangeEnd)
 -+        endZwsp = true;
 -+    if (endZwsp && before > finalBefore)
 -+        before = finalBefore;
 -    while (U_SUCCESS(status) && (current = (int32_t)utext_getNativeIndex(text)) < rangeEnd) {
 -        cuWordLength = 0;
@@ -375,7 +358,17 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -            cpWordLength = words[wordsFound % KHMER_LOOKAHEAD].markedCPLength();
 -            wordsFound += 1;
 -        }
 --
 ++    scanStart = rangeStart;
 ++    scanWJ(text, scanStart, rangeEnd, before, after);
 ++    if (startZwsp || initAfter >= before) {
 ++        after = initAfter;
 ++        before = 0;
 ++    }
 ++    if (!endZwsp && after > finalBefore && after < rangeEnd)
 ++        endZwsp = true;
 ++    if (endZwsp && before > finalBefore)
 ++        before = finalBefore;
 + 
 -        // If there was more than one, see which one can take us forward the most words
 -        else if (candidates > 1) {
 -            // If we're already at the end of the range, we're done
@@ -390,22 +383,6 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -                        words[wordsFound % KHMER_LOOKAHEAD].markCurrent();
 -                        wordsMatched = 2;
 -                    }
 --
 --                    // If we're already at the end of the range, we're done
 --                    if ((int32_t)utext_getNativeIndex(text) >= rangeEnd) {
 --                        goto foundBest;
 --                    }
 --
 --                    // See if any of the possible second words is followed by a third word
 --                    do {
 --                        // If we find a third word, stop right away
 --                        if (words[(wordsFound + 2) % KHMER_LOOKAHEAD].candidates(text, fDictionary, rangeEnd)) {
 --                            words[wordsFound % KHMER_LOOKAHEAD].markCurrent();
 --                            goto foundBest;
 --                        }
 --                    }
 --                    while (words[(wordsFound + 1) % KHMER_LOOKAHEAD].backUp(text));
 --                }
 +    utext_setNativeIndex(text, rangeStart);
 +    int32_t numCodePts = rangeEnd - rangeStart;
 +    // bestSnlp[i] is the snlp of the best segmentation of the first i
@@ -415,7 +392,11 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 +    for(int32_t i = 1; i <= numCodePts; i++) {
 +        bestSnlp.addElement(kuint32max, status);
 +    }
 -+
 + 
 +-                    // If we're already at the end of the range, we're done
 +-                    if ((int32_t)utext_getNativeIndex(text) >= rangeEnd) {
 +-                        goto foundBest;
 +-                    }
 +    // prev[i] is the index of the last code point in the previous word in
 +    // the best segmentation of the first i characters. Note negative implies
 +	// that the code point is part of an unknown word.
@@ -423,7 +404,17 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 +    for(int32_t i = 0; i <= numCodePts; i++) {
 +        prev.addElement(kuint32max, status);
 +    }
 -+
 + 
 +-                    // See if any of the possible second words is followed by a third word
 +-                    do {
 +-                        // If we find a third word, stop right away
 +-                        if (words[(wordsFound + 2) % KHMER_LOOKAHEAD].candidates(text, fDictionary, rangeEnd)) {
 +-                            words[wordsFound % KHMER_LOOKAHEAD].markCurrent();
 +-                            goto foundBest;
 +-                        }
 +-                    }
 +-                    while (words[(wordsFound + 1) % KHMER_LOOKAHEAD].backUp(text));
 +-                }
 +    const int32_t maxWordSize = 20;
 +    UVector32 values(maxWordSize, status);
 +    values.setSize(maxWordSize);
@@ -528,27 +519,17 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -                if (cuWordLength <= 0) {
 -                    wordsFound += 1;
 -                }
 --
 --                // Update the length with the passed-over characters
 --                cuWordLength += chars;
 --            }
 --            else {
 --                // Back up to where we were for next iteration
 --                utext_setNativeIndex(text, current+cuWordLength);
 +                } while (fMarkSet.contains(c) || fIgnoreSet.contains(c));
 +                values.setElementAt(BADSNLP, count);
 +                lengths.setElementAt(utext_getNativeIndex(text) - currix, count++);
 +            } else {
 +                values.setElementAt(BADSNLP, count);
 +                lengths.setElementAt(1, count++);
 -             }
 -         }
 ++            }
 ++        }
 --        // Never stop before a combining mark.
 --        int32_t currPos;
 --        while ((currPos = (int32_t)utext_getNativeIndex(text)) < rangeEnd && fMarkSet.contains(utext_current32(text))) {
 --            utext_next32(text);
 --            cuWordLength += (int32_t)utext_getNativeIndex(text) - currPos;
 +-                // Update the length with the passed-over characters
 +-                cuWordLength += chars;
 +        for (int32_t j = 0; j < count; j++) {
 +            uint32_t v = values.elementAti(j);
 +            int32_t newSnlp = bestSnlp.elementAti(i) + v;
@@ -559,7 +540,10 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 +                ++ln;
 +                utext_next32(text);
 +                c = utext_current32(text);
 -+            }
 +             }
 +-            else {
 +-                // Back up to where we were for next iteration
 +-                utext_setNativeIndex(text, current+cuWordLength);
 +            int32_t ln_j_i = ln + i;   // yes really i!
 +            if (newSnlp < bestSnlp.elementAti(ln_j_i)) {
 +                if (v == BADSNLP) {
@@ -572,9 +556,38 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 +                else
 +                    prev.setElementAt(i, ln_j_i);
 +                bestSnlp.setElementAt(newSnlp, ln_j_i);
 -+            }
 +             }
          }
 -
 +-        // Never stop before a combining mark.
 +-        int32_t currPos;
 +-        while ((currPos = (int32_t)utext_getNativeIndex(text)) < rangeEnd && fMarkSet.contains(utext_current32(text))) {
 +-            utext_next32(text);
 +-            cuWordLength += (int32_t)utext_getNativeIndex(text) - currPos;
 ++    }
 ++    // Start pushing the optimal offset index into t_boundary (t for tentative).
 ++    // prev[numCodePts] is guaranteed to be meaningful.
 ++    // We'll first push in the reverse order, i.e.,
 ++    // t_boundary[0] = numCodePts, and afterwards do a swap.
 ++    UVector32 t_boundary(numCodePts+1, status);
 ++
 ++    int32_t numBreaks = 0;
 ++    // No segmentation found, set boundary to end of range
 ++    while (numCodePts >= 0 && (uint32_t)bestSnlp.elementAti(numCodePts) == kuint32max) {
 ++        --numCodePts;
 ++    }
 ++    if (numCodePts < 0) {
 ++        t_boundary.addElement(numCodePts, status);
 ++        numBreaks++;
 ++    } else {
 ++        for (int32_t i = numCodePts; (uint32_t)i != kuint32max; i = prev.elementAti(i)) {
 ++            if (i < 0) i = -i;
 ++            t_boundary.addElement(i, status);
 ++            numBreaks++;
 +         }
 ++        U_ASSERT(prev.elementAti(t_boundary.elementAti(numBreaks - 1)) == 0);
 ++    }
 + 
 -        // Look ahead for possible suffixes if a dictionary word does not follow.
 -        // We do this in code rather than using a rule so that the heuristic
 -        // resynch continues to function. For example, one of the suffix characters
@@ -616,30 +629,6 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
 -        // Did we find a word on this iteration? If so, push it on the break stack
 -        if (cuWordLength > 0) {
 -            foundBreaks.push((current+cuWordLength), status);
 -+    }
 -+    // Start pushing the optimal offset index into t_boundary (t for tentative).
 -+    // prev[numCodePts] is guaranteed to be meaningful.
 -+    // We'll first push in the reverse order, i.e.,
 -+    // t_boundary[0] = numCodePts, and afterwards do a swap.
 -+    UVector32 t_boundary(numCodePts+1, status);
 -+
 -+    int32_t numBreaks = 0;
 -+    // No segmentation found, set boundary to end of range
 -+    while (numCodePts >= 0 && (uint32_t)bestSnlp.elementAti(numCodePts) == kuint32max) {
 -+        --numCodePts;
 -+    }
 -+    if (numCodePts < 0) {
 -+        t_boundary.addElement(numCodePts, status);
 -+        numBreaks++;
 -+    } else {
 -+        for (int32_t i = numCodePts; (uint32_t)i != kuint32max; i = prev.elementAti(i)) {
 -+            if (i < 0) i = -i;
 -+            t_boundary.addElement(i, status);
 -+            numBreaks++;
 -+        }
 -+        U_ASSERT(prev.elementAti(t_boundary.elementAti(numBreaks - 1)) == 0);
 -+    }
 -+
 +    // Now that we're done, convert positions in t_boundary[] (indices in
 +    // the normalized input string) back to indices in the original input UText
 +    // while reversing t_boundary and pushing values to foundBreaks.
@@ -669,38 +658,35 @@ diff -ur icu.org/source/common/dictbe.cpp icu/source/common/dictbe.cpp
  #if !UCONFIG_NO_NORMALIZATION
 diff -ur icu.org/source/common/dictbe.h icu/source/common/dictbe.h
 ---- icu.org/source/common/dictbe.h	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/dictbe.h	2017-04-21 23:14:23.845894374 +0200
 -@@ -34,6 +34,15 @@
 +--- icu.org/source/common/dictbe.h	2018-03-26 15:38:30.000000000 +0200
 ++++ icu/source/common/dictbe.h	2018-04-17 14:55:33.307639865 +0200
 +@@ -34,7 +34,8 @@
 +  * threads without synchronization.</p>
   */
  class DictionaryBreakEngine : public LanguageBreakEngine {
 -  private:
 -+
 -+  /**
 -+   * <p>Default constructor.</p>
 -+   *
 -+   */
 -+  DictionaryBreakEngine();
 -+
 +- private:
 + protected:
 +
      /**
       * The set of characters handled by this engine
       * @internal
 -@@ -48,11 +57,63 @@
 +@@ -42,14 +43,84 @@
 -   uint32_t      fTypes;
 +   UnicodeSet    fSet;
 +  const int32_t WJ   = 0x2060;
 +  const int32_t ZWSP = 0x200B;
 +
 -   /**
 --   * <p>Default constructor.</p>
 --   *
 ++  /**
 ++   * The break types it was constructed with
 ++   * @internal
 ++   */
 ++  uint32_t      fTypes;
 ++
 ++  /**
 +   * A Unicode set of all viramas
 +   * @internal
 -    */
 --  DictionaryBreakEngine();
 ++   */
 +  UnicodeSet    fViramaSet;
 +
 +  /**
@@ -751,10 +737,26 @@ diff -ur icu.org/source/common/dictbe.h icu/source/common/dictbe.h
 +  bool scanAfterEnd(UText *text, int32_t rangeEnd, int32_t& end, bool &doBreak) const;
 +  void scanBackClusters(UText *text, int32_t textStart, int32_t& start) const;
 +  void scanFwdClusters(UText *text, int32_t textEnd, int32_t& end) const;
 - 
 ++
   public:
 -@@ -83,7 +144,7 @@
 +   /**
 +-   * <p>Constructor </p>
 ++   * <p>Default constructor.</p>
 ++   *
 +    */
 +   DictionaryBreakEngine();
 + 
 +   /**
 ++   * <p>Constructor with break types.</p>
 ++   */
 ++  explicit DictionaryBreakEngine(uint32_t breakTypes);
 ++
 ++  /**
 +    * <p>Virtual destructor.</p>
 +    */
 +   virtual ~DictionaryBreakEngine();
 +@@ -68,7 +139,7 @@
     * <p>Find any breaks within a run in the supplied text.</p>
     *
     * @param text A UText representing the text. The iterator is left at
@@ -763,7 +765,7 @@ diff -ur icu.org/source/common/dictbe.h icu/source/common/dictbe.h
     * that starts from the first character in the range.
     * @param startPos The start of the run within the supplied text.
     * @param endPos The end of the run within the supplied text.
 -@@ -245,118 +306,120 @@
 +@@ -218,118 +289,120 @@
  };
@@ -997,8 +999,8 @@ diff -ur icu.org/source/common/dictbe.h icu/source/common/dictbe.h
  /*******************************************************************
 diff -ur icu.org/source/common/dictionarydata.cpp icu/source/common/dictionarydata.cpp
 ---- icu.org/source/common/dictionarydata.cpp	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/dictionarydata.cpp	2017-04-21 23:14:23.846894372 +0200
 +--- icu.org/source/common/dictionarydata.cpp	2018-03-26 15:38:30.000000000 +0200
 ++++ icu/source/common/dictionarydata.cpp	2018-04-17 14:04:50.775567214 +0200
 @@ -44,7 +44,7 @@
  int32_t UCharsDictionaryMatcher::matches(UText *text, int32_t maxLength, int32_t limit,
@@ -1046,8 +1048,8 @@ diff -ur icu.org/source/common/dictionarydata.cpp icu/source/common/dictionaryda
                  if (values != NULL) {
                      values[wordCount] = bt.getValue();
 diff -ur icu.org/source/common/dictionarydata.h icu/source/common/dictionarydata.h
 ---- icu.org/source/common/dictionarydata.h	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/dictionarydata.h	2017-04-21 23:14:23.846894372 +0200
 +--- icu.org/source/common/dictionarydata.h	2018-03-26 15:38:30.000000000 +0200
 ++++ icu/source/common/dictionarydata.h	2018-04-17 14:04:50.775567214 +0200
 @@ -21,6 +21,7 @@
  #include "unicode/utext.h"
  #include "unicode/udata.h"
@@ -1084,8 +1086,8 @@ diff -ur icu.org/source/common/dictionarydata.h icu/source/common/dictionarydata
  private:
      UChar32 transform(UChar32 c) const;
 diff -ur icu.org/source/data/Makefile.in icu/source/data/Makefile.in
 ---- icu.org/source/data/Makefile.in	2017-04-21 23:13:03.248087545 +0200
 -+++ icu/source/data/Makefile.in	2017-04-21 23:14:23.846894372 +0200
 +--- icu.org/source/data/Makefile.in	2018-04-17 12:28:37.098707466 +0200
 ++++ icu/source/data/Makefile.in	2018-04-17 14:04:50.775567214 +0200
 @@ -183,7 +183,7 @@
  endif
  endif
 diff --git a/external/icu/icu4c-ubsan.patch.1 b/external/icu/icu4c-ubsan.patch.1
 deleted file mode 100644
 index 9f6aa3fbc9f8..000000000000
 --- a/external/icu/icu4c-ubsan.patch.1
 +++ /dev/null
@@ -1,91 +0,0 @@
 -diff -ur icu.org/source/common/rbbidata.h icu/source/common/rbbidata.h
 ---- icu.org/source/common/rbbidata.h	2017-02-03 19:57:23.000000000 +0100
 -+++ icu/source/common/rbbidata.h	2017-04-21 22:46:25.371651160 +0200
 -@@ -115,7 +115,7 @@
 -                                     /*     StatusTable of the set of matching             */
 -                                     /*     tags (rule status values)                      */
 -     int16_t          fReserved;
 --    uint16_t         fNextState[2]; /*  Next State, indexed by char category.             */
 -+    uint16_t         fNextState[1]; /*  Next State, indexed by char category.             */
 -                                     /*  This array does not have two elements             */
 -                                     /*    Array Size is actually fData->fHeader->fCatCount         */
 -                                     /*    CAUTION:  see RBBITableBuilder::getTableSize()  */
 -@@ -128,7 +128,7 @@
 -     uint32_t         fRowLen;       /*  Length of a state table row, in bytes.            */
 -     uint32_t         fFlags;        /*  Option Flags for this state table                 */
 -     uint32_t         fReserved;     /*  reserved                                          */
 --    char             fTableData[4]; /*  First RBBIStateTableRow begins here.              */
 -+    char             fTableData[1]; /*  First RBBIStateTableRow begins here.              */
 -                                     /*    (making it char[] simplifies ugly address       */
 -                                     /*     arithmetic for indexing variable length rows.) */
 - };
 -diff -ur icu.org/source/common/rbbitblb.cpp icu/source/common/rbbitblb.cpp
 ---- icu.org/source/common/rbbitblb.cpp	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/rbbitblb.cpp	2017-04-21 22:46:25.373651159 +0200
 -@@ -1095,15 +1095,15 @@
 -         return 0;
 -     }
 - 
 --    size    = sizeof(RBBIStateTable) - 4;    // The header, with no rows to the table.
 -+    size    = offsetof(RBBIStateTable, fTableData);    // The header, with no rows to the table.
 - 
 -     numRows = fDStates->size();
 -     numCols = fRB->fSetBuilder->getNumCharCategories();
 - 
 --    //  Note  The declaration of RBBIStateTableRow is for a table of two columns.
 --    //        Therefore we subtract two from numCols when determining
 -+    //  Note  The declaration of RBBIStateTableRow is for a table of one columns.
 -+    //        Therefore we subtract one from numCols when determining
 -     //        how much storage to add to a row for the total columns.
 --    rowSize = sizeof(RBBIStateTableRow) + sizeof(uint16_t)*(numCols-2);
 -+    rowSize = sizeof(RBBIStateTableRow) + sizeof(uint16_t)*(numCols-1);
 -     size   += numRows * rowSize;
 -     return size;
 - }
 -@@ -1133,7 +1133,7 @@
 -     }
 - 
 -     table->fRowLen    = sizeof(RBBIStateTableRow) +
 --                            sizeof(uint16_t) * (fRB->fSetBuilder->getNumCharCategories() - 2);
 -+                            sizeof(uint16_t) * (fRB->fSetBuilder->getNumCharCategories() - 1);
 -     table->fNumStates = fDStates->size();
 -     table->fFlags     = 0;
 -     if (fRB->fLookAheadHardBreak) {
 -diff -ur icu.org/source/common/ubidiimp.h icu/source/common/ubidiimp.h
 ---- icu.org/source/common/ubidiimp.h	2017-02-03 19:57:23.000000000 +0100
 -+++ icu/source/common/ubidiimp.h	2017-04-21 22:46:25.374651159 +0200
 -@@ -198,8 +198,8 @@
 - /* in a Run, logicalStart will get this bit set if the run level is odd */
 - #define INDEX_ODD_BIT (1UL<<31)
 - 
 --#define MAKE_INDEX_ODD_PAIR(index, level) ((index)|((int32_t)(level)<<31))
 --#define ADD_ODD_BIT_FROM_LEVEL(x, level)  ((x)|=((int32_t)(level)<<31))
 -+#define MAKE_INDEX_ODD_PAIR(index, level) ((index)|((uint32_t)(level)<<31))
 -+#define ADD_ODD_BIT_FROM_LEVEL(x, level)  ((x)|=((uint32_t)(level)<<31))
 - #define REMOVE_ODD_BIT(x)                 ((x)&=~INDEX_ODD_BIT)
 - 
 - #define GET_INDEX(x)   ((x)&~INDEX_ODD_BIT)
 -diff -ur icu.org/source/common/ucmndata.cpp icu/source/common/ucmndata.cpp
 ---- icu.org/source/common/ucmndata.cpp	2017-03-08 16:34:47.000000000 +0100
 -+++ icu/source/common/ucmndata.cpp	2017-04-21 22:46:25.376651159 +0200
 -@@ -77,7 +77,7 @@
 - typedef struct  {
 -     uint32_t          count;
 -     uint32_t          reserved;
 --    PointerTOCEntry   entry[2];   /* Actual size is from count. */
 -+    PointerTOCEntry   entry[1];   /* Actual size is from count. */
 - }  PointerTOC;
 - 
 - 
 -diff -ur icu.org/source/common/ucmndata.h icu/source/common/ucmndata.h
 ---- icu.org/source/common/ucmndata.h	2017-01-20 01:20:31.000000000 +0100
 -+++ icu/source/common/ucmndata.h	2017-04-21 22:46:25.377651159 +0200
 -@@ -52,7 +52,7 @@
 - 
 - typedef struct {
 -     uint32_t count;
 --    UDataOffsetTOCEntry entry[2];    /* Actual size of array is from count. */
 -+    UDataOffsetTOCEntry entry[1];    /* Actual size of array is from count. */
 - } UDataOffsetTOC;
 - 
 - /**
 --------------erAck-patch-parts--
--- a/SOURCES/0001-Upgrade-to-ICU-62.1.patch
+++ b/SOURCES/0001-Upgrade-to-ICU-62.1.patch
@ -1,236 +0,0 @@
 From 86dfa34c6d83b70923d462fecad316dafd9a1fc4 Mon Sep 17 00:00:00 2001
 Message-Id: <86dfa34c6d83b70923d462fecad316dafd9a1fc4.1531839924.git.erack@redhat.com>
 From: Eike Rathke <erack@redhat.com>
 Date: Mon, 16 Jul 2018 15:20:32 +0200
 Subject: [PATCH] Upgrade to ICU 62.1
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: I9426e77aa85cfe068df59db47b8ac50b59cd4eb3
 Reviewed-on: https://gerrit.libreoffice.org/57500
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 ---
 configure.ac                        |  2 +-
 download.lst                        |  8 +++----
 external/icu/UnpackedTarball_icu.mk |  1 -
 external/icu/icu4c-mkdir.patch.1    |  6 ++---
 external/icu/ofz4860.patch.2        | 25 ---------------------
 i18nutil/source/utility/unicode.cxx | 23 +++++++++++++++++++
 include/svx/strings.hrc             | 11 +++++++++
 svx/source/dialog/charmap.cxx       | 35 +++++++++++++++++++++++++++++
 8 files changed, 77 insertions(+), 34 deletions(-)
 delete mode 100644 external/icu/ofz4860.patch.2
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-Upgrade-to-ICU-62.1.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-Upgrade-to-ICU-62.1.patch"
 diff --git a/configure.ac b/configure.ac
 index 23b3fd4953c9..2fd11a9b3d19 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -9066,7 +9066,7 @@ SYSTEM_GENBRK=
 SYSTEM_GENCCODE=
 SYSTEM_GENCMN=
 -ICU_MAJOR=61
 +ICU_MAJOR=62
 ICU_MINOR=1
 ICU_RECLASSIFIED_PREPEND_SET_EMPTY="TRUE"
 ICU_RECLASSIFIED_CONDITIONAL_JAPANESE_STARTER="TRUE"
 diff --git a/download.lst b/download.lst
 index dd3519b74a8d..0d4e974ed105 100644
 --- a/download.lst
 +++ b/download.lst
@@ -102,10 +102,10 @@ export HUNSPELL_SHA256SUM := 3cd9ceb062fe5814f668e4f22b2fa6e3ba0b339b921739541ce
 export HUNSPELL_TARBALL := hunspell-1.6.2.tar.gz
 export HYPHEN_SHA256SUM := 304636d4eccd81a14b6914d07b84c79ebb815288c76fe027b9ebff6ff24d5705
 export HYPHEN_TARBALL := 5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz
 -export ICU_SHA256SUM := d007f89ae8a2543a53525c74359b65b36412fa84b3349f1400be6dcf409fafef
 -export ICU_TARBALL := icu4c-61_1-src.tgz
 -export ICU_DATA_SHA256SUM := d149ed0985b5a6e16a9d8ed66f105dd58fd334c276779f74241cfa656ed2830a
 -export ICU_DATA_TARBALL := icu4c-61_1-data.zip
 +export ICU_SHA256SUM := 3dd9868d666350dda66a6e305eecde9d479fb70b30d5b55d78a1deffb97d5aa3
 +export ICU_TARBALL := icu4c-62_1-src.tgz
 +export ICU_DATA_SHA256SUM := 93bcaf58cfa9223972da79cb8e0f94819ace4995db6041b84f4d9bd810246d1d
 +export ICU_DATA_TARBALL := icu4c-62_1-data.zip
 export JFREEREPORT_FLOW_ENGINE_SHA256SUM := 233f66e8d25c5dd971716d4200203a612a407649686ef3b52075d04b4c9df0dd
 export JFREEREPORT_FLOW_ENGINE_TARBALL := ba2930200c9f019c2d93a8c88c651a0f-flow-engine-0.9.4.zip
 export JFREEREPORT_FLUTE_SHA256SUM := 1b5b24f7bc543c0362b667692f78db8bab4ed6dafc6172f104d0bd3757d8a133
 diff --git a/external/icu/UnpackedTarball_icu.mk b/external/icu/UnpackedTarball_icu.mk
 index c789e6eb8d84..6800c1fb5ea8 100644
 --- a/external/icu/UnpackedTarball_icu.mk
 +++ b/external/icu/UnpackedTarball_icu.mk
@@ -34,7 +34,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,icu,\
 	external/icu/icu4c-clang-cl.patch.1 \
 	$(if $(filter-out ANDROID,$(OS)),external/icu/icu4c-icudata-stdlibs.patch.1) \
 	external/icu/icu4c-khmerbreakengine.patch.1 \
 -	external/icu/ofz4860.patch.2 \
 	external/icu/icu4c-61-werror-shadow.patch.1 \
 ))
 diff --git a/external/icu/icu4c-mkdir.patch.1 b/external/icu/icu4c-mkdir.patch.1
 index 3234f151b677..7de4cf51174c 100644
 --- a/external/icu/icu4c-mkdir.patch.1
 +++ b/external/icu/icu4c-mkdir.patch.1
@@ -1,10 +1,10 @@
 diff -ur icu.org/source/data/Makefile.in icu/source/data/Makefile.in
 ---- icu.org/source/data/Makefile.in	2016-06-15 20:58:17.000000000 +0200
 -+++ icu/source/data/Makefile.in	2017-04-21 22:29:00.747158002 +0200
 +--- icu.org/source/data/Makefile.in	2018-06-21 11:39:15.000000000 +0200
 ++++ icu/source/data/Makefile.in	2018-07-16 13:18:26.928109541 +0200
 @@ -367,6 +367,7 @@
  ifeq ($(PKGDATA_MODE),dll)
  SO_VERSION_DATA = $(OUTTMPDIR)/icudata.res
 - $(SO_VERSION_DATA) : $(MISCSRCDIR)/icudata.rc
 + $(SO_VERSION_DATA) : $(MISCSRCDIR)/icudata.rc | build-dir
 +	mkdir -p $(OUTTMPDIR)
  ifeq ($(MSYS_RC_MODE),1)
  	rc.exe -i$(srcdir)/../common -i$(top_builddir)/common -fo$@ $(CPPFLAGS) $<
 diff --git a/external/icu/ofz4860.patch.2 b/external/icu/ofz4860.patch.2
 deleted file mode 100644
 index 14114d52878b..000000000000
 --- a/external/icu/ofz4860.patch.2
 +++ /dev/null
@@ -1,25 +0,0 @@
 -From 529ba01ee606940ca273b187be8ce9ba31cf2d90 Mon Sep 17 00:00:00 2001
 -From: David Tardon <dtardon@redhat.com>
 -Date: Fri, 19 Jan 2018 10:41:02 +0100
 -Subject: [PATCH] ofz#4860 fix past-the-end read from array
 -
 ----
 - icu4c/source/common/locmap.cpp | 2 +-
 - 1 file changed, 1 insertion(+), 1 deletion(-)
 -
 -diff --git a/icu4c/source/common/locmap.cpp b/icu4c/source/common/locmap.cpp
 -index cbb2b810a..6d62d8310 100644
 ---- a/icu4c/source/common/locmap.cpp
 -+++ b/icu4c/source/common/locmap.cpp
 -@@ -1015,7 +1015,7 @@ static const char*
 - getPosixID(const ILcidPosixMap *this_0, uint32_t hostID)
 - {
 -     uint32_t i;
 --    for (i = 0; i <= this_0->numRegions; i++)
 -+    for (i = 0; i < this_0->numRegions; i++)
 -     {
 -         if (this_0->regionMaps[i].hostID == hostID)
 -         {
 --- 
 -2.14.3
 -
 diff --git a/i18nutil/source/utility/unicode.cxx b/i18nutil/source/utility/unicode.cxx
 index 6d90b15ca42e..876750d6119d 100644
 --- a/i18nutil/source/utility/unicode.cxx
 +++ b/i18nutil/source/utility/unicode.cxx
@@ -726,6 +726,29 @@ OString unicode::getExemplarLanguageForUScriptCode(UScriptCode eScript)
         case USCRIPT_ZANABAZAR_SQUARE:
             sRet = "mn-Zanb";   // abugida to write Mongolian
             break;
 +#endif
 +#if (U_ICU_VERSION_MAJOR_NUM >= 62)
 +        case USCRIPT_DOGRA:
 +            sRet = "dgo";       // Dogri proper
 +            break;
 +        case USCRIPT_GUNJALA_GONDI:
 +            sRet = "wsg";       // Adilabad Gondi
 +            break;
 +        case USCRIPT_MAKASAR:
 +            sRet = "mak";
 +            break;
 +        case USCRIPT_MEDEFAIDRIN:
 +            sRet = "mis-Medf";  // Uncoded with script
 +            break;
 +        case USCRIPT_HANIFI_ROHINGYA:
 +            sRet = "rhg";
 +            break;
 +        case USCRIPT_SOGDIAN:
 +            sRet = "sog";
 +            break;
 +        case USCRIPT_OLD_SOGDIAN:
 +            sRet = "sog";
 +            break;
 #endif
     }
     return sRet;
 # Slightly adapted to rawhide/F29 libreoffice-6-0-6
 diff --git a/include/svx/strings.hrc b/include/svx/strings.hrc
 index 86c2215ac1c4..18fd984a1bd8 100644
 --- a/include/svx/strings.hrc
 +++ b/include/svx/strings.hrc
@@ -1656,6 +1656,17 @@
 #define RID_SUBSETSTR_SOYOMBO                               NC_("RID_SUBSETMAP", "Soyombo")
 #define RID_SUBSETSTR_SYRIAC_SUPPLEMENT                     NC_("RID_SUBSETMAP", "Syriac Supplement")
 #define RID_SUBSETSTR_ZANABAZAR_SQUARE                      NC_("RID_SUBSETMAP", "Zanabazar Square")
 +#define RID_SUBSETSTR_CHESS_SYMBOLS                         NC_("RID_SUBSETMAP", "Chess Symbols")
 +#define RID_SUBSETSTR_DOGRA                                 NC_("RID_SUBSETMAP", "Dogra")
 +#define RID_SUBSETSTR_GEORGIAN_EXTENDED                     NC_("RID_SUBSETMAP", "Georgian Extended")
 +#define RID_SUBSETSTR_GUNJALA_GONDI                         NC_("RID_SUBSETMAP", "Gunjala Gondi")
 +#define RID_SUBSETSTR_HANIFI_ROHINGYA                       NC_("RID_SUBSETMAP", "Hanifi Rohingya")
 +#define RID_SUBSETSTR_INDIC_SIYAQ_NUMBERS                   NC_("RID_SUBSETMAP", "Indic Siyaq Numbers")
 +#define RID_SUBSETSTR_MAKASAR                               NC_("RID_SUBSETMAP", "Makasar")
 +#define RID_SUBSETSTR_MAYAN_NUMERALS                        NC_("RID_SUBSETMAP", "Mayan Numerals")
 +#define RID_SUBSETSTR_MEDEFAIDRIN                           NC_("RID_SUBSETMAP", "Medefaidrin")
 +#define RID_SUBSETSTR_OLD_SOGDIAN                           NC_("RID_SUBSETMAP", "Old Sogdian")
 +#define RID_SUBSETSTR_SOGDIAN                               NC_("RID_SUBSETMAP", "Sogdian")
 #endif
 diff --git a/svx/source/dialog/charmap.cxx b/svx/source/dialog/charmap.cxx
 index 3bf3a01d520f..fcaa955541df 100644
 --- a/svx/source/dialog/charmap.cxx
 +++ b/svx/source/dialog/charmap.cxx
@@ -1744,6 +1744,41 @@ void SubsetMap::InitList()
                     aAllSubsets.emplace_back( 0x11A00, 0x11A4F, SvxResId(RID_SUBSETSTR_ZANABAZAR_SQUARE) );
                     break;
 #endif
 +#if (U_ICU_VERSION_MAJOR_NUM >= 62)
 +                case UBLOCK_CHESS_SYMBOLS:
 +                    aAllSubsets.emplace_back( 0x1FA00, 0x1FA6F, SvxResId(RID_SUBSETSTR_CHESS_SYMBOLS) );
 +                    break;
 +                case UBLOCK_DOGRA:
 +                    aAllSubsets.emplace_back( 0x11800, 0x1184F, SvxResId(RID_SUBSETSTR_DOGRA) );
 +                    break;
 +                case UBLOCK_GEORGIAN_EXTENDED:
 +                    aAllSubsets.emplace_back( 0x1C90, 0x1CBF, SvxResId(RID_SUBSETSTR_GEORGIAN_EXTENDED) );
 +                    break;
 +                case UBLOCK_GUNJALA_GONDI:
 +                    aAllSubsets.emplace_back( 0x11D60, 0x11DAF, SvxResId(RID_SUBSETSTR_GUNJALA_GONDI) );
 +                    break;
 +                case UBLOCK_HANIFI_ROHINGYA:
 +                    aAllSubsets.emplace_back( 0x10D00, 0x10D3F, SvxResId(RID_SUBSETSTR_HANIFI_ROHINGYA) );
 +                    break;
 +                case UBLOCK_INDIC_SIYAQ_NUMBERS:
 +                    aAllSubsets.emplace_back( 0x1EC70, 0x1ECBF, SvxResId(RID_SUBSETSTR_INDIC_SIYAQ_NUMBERS) );
 +                    break;
 +                case UBLOCK_MAKASAR:
 +                    aAllSubsets.emplace_back( 0x11EE0, 0x11EFF, SvxResId(RID_SUBSETSTR_MAKASAR) );
 +                    break;
 +                case UBLOCK_MAYAN_NUMERALS:
 +                    aAllSubsets.emplace_back( 0x1D2E0, 0x1D2FF, SvxResId(RID_SUBSETSTR_MAYAN_NUMERALS) );
 +                    break;
 +                case UBLOCK_MEDEFAIDRIN:
 +                    aAllSubsets.emplace_back( 0x16E40, 0x16E9F, SvxResId(RID_SUBSETSTR_MEDEFAIDRIN) );
 +                    break;
 +                case UBLOCK_OLD_SOGDIAN:
 +                    aAllSubsets.emplace_back( 0x10F00, 0x10F2F, SvxResId(RID_SUBSETSTR_OLD_SOGDIAN) );
 +                    break;
 +                case UBLOCK_SOGDIAN:
 +                    aAllSubsets.emplace_back( 0x10F30, 0x10F6F, SvxResId(RID_SUBSETSTR_SOGDIAN) );
 +                    break;
 +#endif
             }
 --------------erAck-patch-parts--
--- a/SOURCES/0001-Use-ICU_MAJOR-instead-of-hard-coded-Upgrade-to-ICU-6.patch
+++ b/SOURCES/0001-Use-ICU_MAJOR-instead-of-hard-coded-Upgrade-to-ICU-6.patch
@ -1,43 +0,0 @@
 From 1d3de59ac2d12e42e12c9642bd252236a80b096b Mon Sep 17 00:00:00 2001
 Message-Id: <1d3de59ac2d12e42e12c9642bd252236a80b096b.1531842210.git.erack@redhat.com>
 From: Eike Rathke <erack@redhat.com>
 Date: Tue, 17 Jul 2018 17:37:55 +0200
 Subject: [PATCH] Use $(ICU_MAJOR) instead of hard coded (Upgrade to ICU 62.1)
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: Ifea7072922388b2c0b7631fb809b23e2a5524a3c
 ---
 ios/CustomTarget_iOS_setup.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-Use-ICU_MAJOR-instead-of-hard-coded-Upgrade-to-ICU-6.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-Use-ICU_MAJOR-instead-of-hard-coded-Upgrade-to-ICU-6.patch"
 # Slightly adapted to rawhide/F29 libreoffice-6-0-6
 diff --git a/ios/CustomTarget_iOS_setup.mk b/ios/CustomTarget_iOS_setup.mk
 index a0d1a18823ab..718bb8b90d46 100644
 --- a/ios/CustomTarget_iOS_setup.mk
 +++ b/ios/CustomTarget_iOS_setup.mk
@@ -32,7 +32,7 @@ $(IOSGEN)/native-code.h: $(BUILDDIR)/config_host.mk $(SRCDIR)/ios/CustomTarget_iOS_setup.mk
 	    > $(IOSGEN)/native-code.h
 	# generate resource files used to start/run LibreOffice
 -	cp $(WORKDIR)/UnpackedTarball/icu/source/data/in/icudt61l.dat $(IOSRES)/icudt61l.dat
 +	cp $(WORKDIR)/UnpackedTarball/icu/source/data/in/icudt$(ICU_MAJOR)l.dat $(IOSRES)/icudt$(ICU_MAJOR)l.dat
 	cp $(INSTDIR)/program/types.rdb             $(IOSRES)/udkapi.rdb
 	cp $(INSTDIR)/program/types/offapi.rdb      $(IOSRES)
 	cp $(INSTDIR)/program/types/oovbaapi.rdb    $(IOSRES)
 --------------erAck-patch-parts--
--- a/SOURCES/0001-We-use-ICU-61-now.patch
+++ b/SOURCES/0001-We-use-ICU-61-now.patch
@ -1,43 +0,0 @@
 From b9dde4a74cba5a771cbc85880d518f6717d19216 Mon Sep 17 00:00:00 2001
 Message-Id: <b9dde4a74cba5a771cbc85880d518f6717d19216.1531842189.git.erack@redhat.com>
 From: Tor Lillqvist <tml@collabora.com>
 Date: Thu, 7 Jun 2018 21:51:14 +0300
 Subject: [PATCH] We use ICU 61 now
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: I7faf23de08db680599658206faaf3028888563f6
 ---
 ios/CustomTarget_iOS_setup.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-We-use-ICU-61-now.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-We-use-ICU-61-now.patch"
 # Slightly adapted to rawhide/F29 libreoffice-6-0-6
 diff --git a/ios/CustomTarget_iOS_setup.mk b/ios/CustomTarget_iOS_setup.mk
 index a9f98850c6d8..a0d1a18823ab 100644
 --- a/ios/CustomTarget_iOS_setup.mk
 +++ b/ios/CustomTarget_iOS_setup.mk
@@ -32,7 +32,7 @@ $(IOSGEN)/native-code.h: $(BUILDDIR)/config_host.mk $(SRCDIR)/ios/CustomTarget_iOS_setup.mk
 	    > $(IOSGEN)/native-code.h
 	# generate resource files used to start/run LibreOffice
 -	cp $(WORKDIR)/UnpackedTarball/icu/source/data/in/icudt60l.dat $(IOSRES)/icudt60l.dat
 +	cp $(WORKDIR)/UnpackedTarball/icu/source/data/in/icudt61l.dat $(IOSRES)/icudt61l.dat
 	cp $(INSTDIR)/program/types.rdb             $(IOSRES)/udkapi.rdb
 	cp $(INSTDIR)/program/types/offapi.rdb      $(IOSRES)
 	cp $(INSTDIR)/program/types/oovbaapi.rdb    $(IOSRES)
 --------------erAck-patch-parts--
--- a/SOURCES/0001-backports-to-ease-CVE-backporting.patch
+++ b/SOURCES/0001-backports-to-ease-CVE-backporting.patch
@ -0,0 +1,259 @@
 From c2cf13da3bbf756ef3f78251c40d45fc23c27f36 Mon Sep 17 00:00:00 2001
 From: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
 Date: Wed, 29 Apr 2020 07:42:24 +0200
 Subject: [PATCH 1/6] backports to ease CVE backporting
 Remove unnecessary if block
 And format code inside
 Change-Id: Ied0d98935134bf6f7bc8c929645ad5faac9affa3
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93116
 Tested-by: Jenkins
 Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
 (cherry picked from commit cf36fe5eb41910c26d58fb25e54ccf2e0ee01365)
 space out the namespace constant values
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/88938
 (cherry picked from commit 5352d45dd4a04f8f02cf7f6ad4169126d3b3586a)
 Change-Id: I30f54bfc1389e91b18e4fee8b83e1b297419899b
 ---
 include/xmloff/xmlnmspe.hxx                   |  16 +--
 .../component/documentdigitalsignatures.cxx   | 130 +++++++++---------
 .../source/helper/xmlsignaturehelper.cxx      |   1 +
 3 files changed, 75 insertions(+), 72 deletions(-)
 diff --git a/include/xmloff/xmlnmspe.hxx b/include/xmloff/xmlnmspe.hxx
 index a00628b6b999..b079053c38d3 100644
 --- a/include/xmloff/xmlnmspe.hxx
 +++ b/include/xmloff/xmlnmspe.hxx
@@ -69,7 +69,7 @@ XML_NAMESPACE( XML_NAMESPACE_VERSIONS_LIST,   37U )
 // namespaces for odf extended formats
 -#define XML_NAMESPACE_EXT_BASE 38U
 +#define XML_NAMESPACE_EXT_BASE 50U
 #define XML_NAMESPACE_EXT( prefix, index ) \
 const sal_uInt16 prefix = (XML_NAMESPACE_EXT_BASE+index);
@@ -82,7 +82,7 @@ XML_NAMESPACE_EXT( XML_NAMESPACE_LO_EXT,           5U )
 // namespaces for OOo formats
 -#define XML_NAMESPACE_OOO_BASE 44U
 +#define XML_NAMESPACE_OOO_BASE 60U
 #define XML_NAMESPACE_OOO( prefix, index ) \
 const sal_uInt16 prefix = (XML_NAMESPACE_OOO_BASE+index);
@@ -100,7 +100,7 @@ XML_NAMESPACE_OOO( XML_NAMESPACE_CONFIG_OOO,        10U )
 XML_NAMESPACE_OOO( XML_NAMESPACE_FORM_OOO,          11U )
 XML_NAMESPACE_OOO( XML_NAMESPACE_SCRIPT_OOO,        12U )
 -#define XML_NAMESPACE_COMPAT_BASE 57U
 +#define XML_NAMESPACE_COMPAT_BASE 80U
 #define XML_NAMESPACE_COMPAT( prefix, index ) \
 const sal_uInt16 prefix = (XML_NAMESPACE_COMPAT_BASE+index);
@@ -108,14 +108,14 @@ XML_NAMESPACE_COMPAT( XML_NAMESPACE_SVG_COMPAT,      0U )
 XML_NAMESPACE_COMPAT( XML_NAMESPACE_FO_COMPAT,       1U )
 XML_NAMESPACE_COMPAT( XML_NAMESPACE_SMIL_COMPAT,     2U )
 -#define XML_NAMESPACE_OASIS_BASE 60U
 +#define XML_NAMESPACE_OASIS_BASE 90U
 #define XML_NAMESPACE_OASIS( prefix, index ) \
 const sal_uInt16 prefix = (XML_NAMESPACE_OASIS_BASE+index);
 XML_NAMESPACE_OASIS( XML_NAMESPACE_DB_OASIS,         0U )
 XML_NAMESPACE_OASIS( XML_NAMESPACE_REPORT_OASIS,     1U )
 -#define XML_OLD_NAMESPACE_BASE 62U
 +#define XML_OLD_NAMESPACE_BASE 100U
 #define XML_OLD_NAMESPACE( prefix, index ) \
 const sal_uInt16 prefix = (XML_OLD_NAMESPACE_BASE+index);
@@ -134,9 +134,9 @@ XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_CHART,         10U )
 XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_SMIL,          11U )
 // experimental namespaces
 -XML_NAMESPACE( XML_NAMESPACE_FIELD,           100U )
 -XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        103U )  // CSS Text Level 3
 -XML_NAMESPACE( XML_NAMESPACE_FORMX,           101U )  // form interop extensions
 +XML_NAMESPACE( XML_NAMESPACE_FIELD,           120U )
 +XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        123U )  // CSS Text Level 3
 +XML_NAMESPACE( XML_NAMESPACE_FORMX,           121U )  // form interop extensions
 #endif // INCLUDED_XMLOFF_XMLNMSPE_HXX
 diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
 index dcfaad0af773..52cb938a8e0a 100644
 --- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
 +++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
@@ -500,85 +500,87 @@ DocumentDigitalSignatures::ImplVerifySignatures(
     Sequence< css::security::DocumentSignatureInformation > aInfos(nInfos);
     css::security::DocumentSignatureInformation* arInfos = aInfos.getArray();
 -    if ( nInfos )
 +    for (int n = 0; n < nInfos; ++n)
     {
 -        for( int n = 0; n < nInfos; ++n )
 -        {
 -            DocumentSignatureAlgorithm mode = DocumentSignatureHelper::getDocumentAlgorithm(
 -                m_sODFVersion, aSignInfos[n]);
 -            const std::vector< OUString > aElementsToBeVerified =
 -                DocumentSignatureHelper::CreateElementList(
 -                rxStorage, eMode, mode);
 +        DocumentSignatureAlgorithm mode
 +            = DocumentSignatureHelper::getDocumentAlgorithm(m_sODFVersion, aSignInfos[n]);
 +        const std::vector<OUString> aElementsToBeVerified
 +            = DocumentSignatureHelper::CreateElementList(rxStorage, eMode, mode);
 -            const SignatureInformation& rInfo = aSignInfos[n];
 -            css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
 +        const SignatureInformation& rInfo = aSignInfos[n];
 +        css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
 -            if (rInfo.ouGpgCertificate.isEmpty()) // X.509
 +        if (rInfo.ouGpgCertificate.isEmpty()) // X.509
 +        {
 +            if (!rInfo.ouX509Certificate.isEmpty())
 +                rSigInfo.Signer = xSecEnv->createCertificateFromAscii(rInfo.ouX509Certificate);
 +            if (!rSigInfo.Signer.is())
 +                rSigInfo.Signer = xSecEnv->getCertificate(
 +                    rInfo.ouX509IssuerName,
 +                    xmlsecurity::numericStringToBigInteger(rInfo.ouX509SerialNumber));
 +
 +            // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
 +            // to find the parent certificate. It does not take into account that there can be several certificates
 +            // with the same subject name.
 +            try
             {
 -                if (!rInfo.ouX509Certificate.isEmpty())
 -                    rSigInfo.Signer = xSecEnv->createCertificateFromAscii( rInfo.ouX509Certificate ) ;
 -                if (!rSigInfo.Signer.is())
 -                    rSigInfo.Signer = xSecEnv->getCertificate( rInfo.ouX509IssuerName,
 -                                                               xmlsecurity::numericStringToBigInteger( rInfo.ouX509SerialNumber ) );
 -
 -                // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
 -                // to find the parent certificate. It does not take into account that there can be several certificates
 -                // with the same subject name.
 -
 -                try {
 -                    rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(rSigInfo.Signer,
 -                                                                            Sequence<Reference<css::security::XCertificate> >());
 -                } catch (SecurityException& ) {
 -                    OSL_FAIL("Verification of certificate failed");
 -                    rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
 -                }
 +                rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(
 +                    rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
             }
 -            else if (xGpgSecEnv.is()) // GPG
 +            catch (SecurityException&)
             {
 -                // TODO not ideal to retrieve cert by keyID, might
 -                // collide, or PGPKeyID format might change - can't we
 -                // keep the xCert itself in rInfo?
 -                rSigInfo.Signer = xGpgSecEnv->getCertificate( rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger("") );
 -                rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(rSigInfo.Signer,
 -                                                                           Sequence<Reference<css::security::XCertificate> >());
 +                OSL_FAIL("Verification of certificate failed");
 +                rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
             }
 +        }
 +        else if (xGpgSecEnv.is()) // GPG
 +        {
 +            // TODO not ideal to retrieve cert by keyID, might
 +            // collide, or PGPKeyID format might change - can't we
 +            // keep the xCert itself in rInfo?
 +            rSigInfo.Signer = xGpgSecEnv->getCertificate(
 +                rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger(""));
 +            rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(
 +                rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
 +        }
 -            // Time support again (#i38744#)
 -            Date aDate( rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year );
 -            tools::Time aTime( rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
 -                        rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds );
 -            rSigInfo.SignatureDate = aDate.GetDate();
 -            rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
 +        // Time support again (#i38744#)
 +        Date aDate(rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year);
 +        tools::Time aTime(rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
 +                          rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds);
 +        rSigInfo.SignatureDate = aDate.GetDate();
 +        rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
 -            rSigInfo.SignatureIsValid = ( rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED );
 +        rSigInfo.SignatureIsValid
 +            = (rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED);
 -            // Signature line info (ID + Images)
 -            if (!rInfo.ouSignatureLineId.isEmpty())
 -                rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
 +        // Signature line info (ID + Images)
 +        if (!rInfo.ouSignatureLineId.isEmpty())
 +            rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
 -            if (rInfo.aValidSignatureImage.is())
 -                rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
 +        if (rInfo.aValidSignatureImage.is())
 +            rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
 -            if (rInfo.aInvalidSignatureImage.is())
 -                rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
 -
 -            // OOXML intentionally doesn't sign metadata.
 -            if ( rSigInfo.SignatureIsValid && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
 -            {
 -                 rSigInfo.SignatureIsValid =
 -                      DocumentSignatureHelper::checkIfAllFilesAreSigned(
 -                      aElementsToBeVerified, rInfo, mode);
 -            }
 -            if (eMode == DocumentSignatureMode::Content)
 -            {
 -                if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
 -                    rSigInfo.PartialDocumentSignature = true;
 -                else
 -                    rSigInfo.PartialDocumentSignature = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
 -            }
 +        if (rInfo.aInvalidSignatureImage.is())
 +            rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
 +        // OOXML intentionally doesn't sign metadata.
 +        if (rSigInfo.SignatureIsValid
 +            && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
 +        {
 +            rSigInfo.SignatureIsValid = DocumentSignatureHelper::checkIfAllFilesAreSigned(
 +                aElementsToBeVerified, rInfo, mode);
 +        }
 +        if (eMode == DocumentSignatureMode::Content)
 +        {
 +            if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
 +                rSigInfo.PartialDocumentSignature = true;
 +            else
 +                rSigInfo.PartialDocumentSignature
 +                    = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
         }
     }
 +
     return aInfos;
 }
 diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
 index 6ec834053a17..22c056e70da1 100644
 --- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
 +++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
@@ -402,6 +402,7 @@ bool XMLSignatureHelper::ReadAndVerifySignatureStorageStream(const css::uno::Ref
     catch(const uno::Exception&)
     {
         DBG_UNHANDLED_EXCEPTION("xmlsecurity.helper");
 +        mbError = true;
     }
     mpXSecController->releaseSignatureReader();
 -- 
 2.32.0
--- a/SOURCES/0001-cov-scan-help-warnings.patch
+++ b/SOURCES/0001-cov-scan-help-warnings.patch
@ -1,25 +0,0 @@
 From fa5f426359bbe1b6a9c521130bf7bbee2e60f69f Mon Sep 17 00:00:00 2001
 From: rpmbuild <rpmbuild@fedoraproject.org>
 Date: Wed, 18 Jul 2018 15:31:31 +0100
 Subject: [PATCH] foo
 ---
 helpcontent2/to-wiki/wikiconv2.py                       | 2 --
 5 files changed, 7 insertions(+), 12 deletions(-)
 diff --git a/helpcontent2/to-wiki/wikiconv2.py b/helpcontent2/to-wiki/wikiconv2.py
 index 93f72eb..55ff72f 100755
 --- a/helpcontent2/to-wiki/wikiconv2.py
 +++ b/helpcontent2/to-wiki/wikiconv2.py
@@ -1071,8 +1071,6 @@ class Item(ElementBase):
                 sys.stderr.write('Unhandled item type. Possibly type has been localized.\n')
             finally:
                 raise UnhandledItemType
 -        return replace_text(self.text)
 -
 class Paragraph(ElementBase):
     def __init__(self, attrs, parent):
 -- 
 2.14.4
--- a/SOURCES/0001-cov-scan-warnings.patch
+++ b/SOURCES/0001-cov-scan-warnings.patch
--- a/SOURCES/0001-disable-libe-book-support.patch
+++ b/SOURCES/0001-disable-libe-book-support.patch
@ -1,18 +1,17 @@
-From 613af296887aede8f5b0fa6f94f7fb2781403ef2 Mon Sep 17 00:00:00 2001
+From 702a1ad668167a7a8efdd694c820b710a765bb53 Mon Sep 17 00:00:00 2001
 From: David Tardon <dtardon@redhat.com>
 Date: Thu, 21 Aug 2014 16:10:51 +0200
 Subject: [PATCH] disable libe-book support
 Change-Id: Ie915a9bd2acf7f3aeb8b0933252da33c17043bc4
 ---
 configure.ac                                     | 3 ---
 external/Module_external.mk                      | 1 -
 filter/Configuration_filter.mk                   | 8 --------
 writerperfect/Library_wpftwriter.mk              | 2 --
- writerperfect/qa/unit/WpftFilterFixture.hxx      | 3 ---
+ writerperfect/qa/unit/WpftFilterFixture.hxx      | 4 ----
 writerperfect/qa/unit/WpftWriterFilterTest.cxx   | 5 -----
 writerperfect/source/writer/wpftwriter.component | 5 -----
- 7 files changed, 27 deletions(-)
+ 6 files changed, 25 deletions(-)
 diff --git a/configure.ac b/configure.ac
 index ac8dbc5..bb08d21 100644
@ -29,10 +28,10 @@ index ac8dbc5..bb08d21 100644
 libo_CHECK_SYSTEM_MODULE([libpagemaker],[PAGEMAKER],[libpagemaker-0.0])
 diff --git a/external/Module_external.mk b/external/Module_external.mk
-index 590e216..8f19768 100644
+index baf7215..397ad68 100644
 --- a/external/Module_external.mk
 +++ b/external/Module_external.mk
-@@ -32,7 +32,6 @@ $(eval $(call gb_Module_add_moduledirs,external,\
+@@ -31,7 +31,6 @@ $(eval $(call gb_Module_add_moduledirs,external,\
 	$(call gb_Helper_optional,CPPUNIT,cppunit) \
 	$(call gb_Helper_optional,CT2N,ct2n) \
 	$(call gb_Helper_optional,CURL,curl) \
@ -41,7 +40,7 @@ index 590e216..8f19768 100644
 	$(call gb_Helper_optional,EPOXY,epoxy) \
 	$(call gb_Helper_optional,EPUBGEN,libepubgen) \
 diff --git a/filter/Configuration_filter.mk b/filter/Configuration_filter.mk
-index 7b39020..588fa01 100644
+index 9702332..d250173 100644
 --- a/filter/Configuration_filter.mk
 +++ b/filter/Configuration_filter.mk
@@ -346,10 +346,6 @@ $(eval $(call filter_Configuration_add_types,fcfg_langpack,fcfg_writer_types.xcu
@ -67,10 +66,10 @@ index 7b39020..588fa01 100644
 	MWAW_Text_Document \
 	Palm_Text_Document \
 diff --git a/writerperfect/Library_wpftwriter.mk b/writerperfect/Library_wpftwriter.mk
-index bf605e7..54a702e 100644
+index 8993cca..b6e11f3 100644
 --- a/writerperfect/Library_wpftwriter.mk
 +++ b/writerperfect/Library_wpftwriter.mk
-@@ -48,7 +48,6 @@ $(eval $(call gb_Library_use_libraries,wpftwriter,\
+@@ -53,7 +53,6 @@ $(eval $(call gb_Library_use_libraries,wpftwriter,\
 $(eval $(call gb_Library_use_externals,wpftwriter,\
 	abw \
 	boost_headers \
@ -78,7 +77,7 @@ index bf605e7..54a702e 100644
 	epubgen \
 	etonyek \
 	icu_headers \
-@@ -67,7 +66,6 @@ $(eval $(call gb_Library_use_externals,wpftwriter,\
+@@ -73,7 +72,6 @@ $(eval $(call gb_Library_use_externals,wpftwriter,\
 $(eval $(call gb_Library_add_exception_objects,wpftwriter,\
 	writerperfect/source/writer/AbiWordImportFilter \
@ -87,42 +86,43 @@ index bf605e7..54a702e 100644
 	writerperfect/source/writer/EPUBExportFilter \
 	writerperfect/source/writer/EPUBExportUIComponent \
 diff --git a/writerperfect/qa/unit/WpftFilterFixture.hxx b/writerperfect/qa/unit/WpftFilterFixture.hxx
-index 14ad4ea..63aff41 100644
+index f324781..f42edb0 100644
 --- a/writerperfect/qa/unit/WpftFilterFixture.hxx
 +++ b/writerperfect/qa/unit/WpftFilterFixture.hxx
-@@ -27,9 +27,6 @@
+@@ -26,10 +26,6 @@
-         ((minor) > (req_minor) \
+         || ((major) == (req_major)                                                                 \
-          || ((minor) == (req_minor) && ((micro) >= (req_micro)))))
+             && ((minor) > (req_minor) || ((minor) == (req_minor) && ((micro) >= (req_micro)))))
 -#define REQUIRE_EBOOK_VERSION(major, minor, micro)                                                 \
-    REQUIRE_VERSION(EBOOK_VERSION_MAJOR, EBOOK_VERSION_MINOR, EBOOK_VERSION_MICRO, major, minor, micro)
+-    REQUIRE_VERSION(EBOOK_VERSION_MAJOR, EBOOK_VERSION_MINOR, EBOOK_VERSION_MICRO, major, minor,   \
 -                    micro)
 -
 #define REQUIRE_ETONYEK_VERSION(major, minor, micro)                                               \
-     REQUIRE_VERSION(ETONYEK_VERSION_MAJOR, ETONYEK_VERSION_MINOR, ETONYEK_VERSION_MICRO, major, minor, micro)
+     REQUIRE_VERSION(ETONYEK_VERSION_MAJOR, ETONYEK_VERSION_MINOR, ETONYEK_VERSION_MICRO, major,    \
- 
+                     minor, micro)
 diff --git a/writerperfect/qa/unit/WpftWriterFilterTest.cxx b/writerperfect/qa/unit/WpftWriterFilterTest.cxx
-index 515a2b8..3180a99 100644
+index 8bc4c7c..eca43ca 100644
 --- a/writerperfect/qa/unit/WpftWriterFilterTest.cxx
 +++ b/writerperfect/qa/unit/WpftWriterFilterTest.cxx
-@@ -31,10 +31,6 @@ WpftWriterFilterTest::WpftWriterFilterTest()
+@@ -30,9 +30,6 @@ WpftWriterFilterTest::WpftWriterFilterTest()
 void WpftWriterFilterTest::test()
 {
-    const writerperfect::test::WpftOptionalMap_t aEBookOptional
+-    const writerperfect::test::WpftOptionalMap_t aEBookOptional{
 -    {
 -        { "FictionBook2.fb2.zip", REQUIRE_EBOOK_VERSION(0, 1, 1) },
 -    };
-     const writerperfect::test::WpftOptionalMap_t aEtonyekOptional
+     const writerperfect::test::WpftOptionalMap_t aEtonyekOptional{
     {
         { "Pages_4.pages", REQUIRE_ETONYEK_VERSION(0, 1, 2) },
-@@ -58,7 +54,6 @@ void WpftWriterFilterTest::test()
+         { "Pages_5.pages", REQUIRE_ETONYEK_VERSION(0, 1, 8) },
-     };
+@@ -54,8 +51,6 @@ void WpftWriterFilterTest::test()
-     doTest("com.sun.star.comp.Writer.AbiWordImportFilter", "/writerperfect/qa/unit/data/writer/libabw/");
+     doTest("com.sun.star.comp.Writer.AbiWordImportFilter",
-    doTest("org.libreoffice.comp.Writer.EBookImportFilter", "/writerperfect/qa/unit/data/writer/libe-book/", aEBookOptional);
+            "/writerperfect/qa/unit/data/writer/libabw/");
-     doTest("com.sun.star.comp.Writer.MSWorksImportFilter", "/writerperfect/qa/unit/data/writer/libwps/", aWpsOptional);
+-    doTest("org.libreoffice.comp.Writer.EBookImportFilter",
-     doTest("com.sun.star.comp.Writer.MWAWImportFilter", "/writerperfect/qa/unit/data/writer/libmwaw/", aMWAWOptional);
+-           "/writerperfect/qa/unit/data/writer/libe-book/", aEBookOptional);
-     doTest("org.libreoffice.comp.Writer.PagesImportFilter", "/writerperfect/qa/unit/data/writer/libetonyek/", aEtonyekOptional);
+     doTest("com.sun.star.comp.Writer.MSWorksImportFilter",
            "/writerperfect/qa/unit/data/writer/libwps/", aWpsOptional);
     doTest("com.sun.star.comp.Writer.MWAWImportFilter",
 diff --git a/writerperfect/source/writer/wpftwriter.component b/writerperfect/source/writer/wpftwriter.component
 index 8ab4366..2720023 100644
 --- a/writerperfect/source/writer/wpftwriter.component
@ -140,5 +140,5 @@ index 8ab4366..2720023 100644
       constructor="org_libreoffice_comp_Writer_PagesImportFilter_get_implementation">
     <service name="com.sun.star.document.ExtendedTypeDetection"/>
 -- 
-2.14.1
+2.26.2
--- a/SOURCES/0001-disable-script-dump.patch
+++ b/SOURCES/0001-disable-script-dump.patch
@ -0,0 +1,99 @@
 From ff68c22161071ce89851c6d81e80ba51b67e8e0c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 13 Feb 2023 13:56:10 +0000
 Subject: [PATCH] disable script dump
 Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986
 Tested-by: Jenkins
 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051
 Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147255
 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
 Reviewed-by: Andras Timar <andras.timar@collabora.com>
 (cherry picked from commit ae3a7dcbb60bb73700737b9ca8940ce3103648d9)
 ---
 .../source/drivers/hsqldb/HDriver.cxx         | 31 +++++++++++++++++++
 external/hsqldb/UnpackedTarball_hsqldb.mk     |  1 +
 .../hsqldb/patches/disable-dump-script.patch  | 14 +++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 external/hsqldb/patches/disable-dump-script.patch
 diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx
 index de76ecbba29de..95c610843efab 100644
 --- a/connectivity/source/drivers/hsqldb/HDriver.cxx
 +++ b/connectivity/source/drivers/hsqldb/HDriver.cxx
@@ -300,6 +300,37 @@ namespace connectivity
                         } // if ( xStream.is() )
                         ::comphelper::disposeComponent(xStream);
                     }
 +
 +                    // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces
 +                    // in that bundled hsqldb 1.8.0 is patched to also reject them)
 +                    //
 +                    // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data
 +                    // which seems to provide a builtin way to do this with contemporary hsqldb
 +                    const OUString sScript( "script" );
 +                    if (!bIsNewDatabase && xStorage->isStreamElement(sScript))
 +                    {
 +                        Reference<XStream > xStream = xStorage->openStreamElement(sScript, ElementModes::READ);
 +                        if (xStream.is())
 +                        {
 +                            std::unique_ptr<SvStream> pStream(::utl::UcbStreamHelper::CreateStream(xStream));
 +                            if (pStream)
 +                            {
 +                                OString sLine;
 +                                while (pStream->ReadLine(sLine))
 +                                {
 +                                    OString sText = sLine.trim();
 +                                    if (sText.startsWithIgnoreAsciiCase("SCRIPT"))
 +                                    {
 +                                        ::connectivity::SharedResources aResources;
 +                                        sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath);
 +                                        break;
 +                                    }
 +                                }
 +                            }
 +                        } // if ( xStream.is() )
 +                        ::comphelper::disposeComponent(xStream);
 +                    }
 +
                 }
                 catch(Exception&)
                 {
 diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk
 index cbba770f19a07..ed262cccf4caa 100644
 --- a/external/hsqldb/UnpackedTarball_hsqldb.mk
 +++ b/external/hsqldb/UnpackedTarball_hsqldb.mk
@@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\
 		external/hsqldb/patches/jdbc-4.1.patch \
 		external/hsqldb/patches/multipleResultSets.patch \
 	) \
 +	external/hsqldb/patches/disable-dump-script.patch \
 ))
 # vim: set noet sw=4 ts=4:
 diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch
 new file mode 100644
 index 0000000000000..401dd38abc9a2
 --- /dev/null
 +++ b/external/hsqldb/patches/disable-dump-script.patch
@@ -0,0 +1,14 @@
 +--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 11:08:11.297243034 +0000
 ++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 13:49:17.973089433 +0000
 +@@ -403,6 +403,11 @@
 +                     throw Trace.error(Trace.INVALID_IDENTIFIER);
 +                 }
 + 
 ++                // added condition to avoid execution of spurious command in .script or .log file
 ++                if (session.isProcessingScript() || session.isProcessingLog()) {
 ++                    return new Result(ResultConstants.UPDATECOUNT);
 ++                }
 ++
 +                 dsw = new ScriptWriterText(database, token, true, true, true);
 + 
 +                 dsw.writeAll();
 -- 
 2.41.0
--- a/SOURCES/0001-disble-tip-of-the-day-dialog-by-default.patch
+++ b/SOURCES/0001-disble-tip-of-the-day-dialog-by-default.patch
@ -0,0 +1,26 @@
 From d6e2cdb0023e422546e3ece5bf9915f7c490ced8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 20 Mar 2020 14:24:05 +0000
 Subject: [PATCH] disble tip-of-the-day dialog by default
 Change-Id: Ie7f0e3fe3dda12c2ec88c376d2b57419253ae5cf
 ---
 officecfg/registry/schema/org/openoffice/Office/Common.xcs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 index e7c339e2e22e..9aa88ef1aa02 100644
 --- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 +++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
@@ -5570,7 +5570,7 @@
         <info>
           <desc>Determines whether the Tip-of-the-Day dialog is shown on startup.</desc>
         </info>
 -        <value>true</value>
 +        <value>false</value>
       </prop>
       <prop oor:name="LastTipOfTheDayShown" oor:type="xs:int" oor:nillable="false">
           <info>
 -- 
 2.24.1
--- a/SOURCES/0001-export-HYPERLINK-target-in-html-clipboard-export.patch
+++ b/SOURCES/0001-export-HYPERLINK-target-in-html-clipboard-export.patch
@ -0,0 +1,64 @@
 From 13aba101eadfe4f67a930ac7231d26ece658bbec Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 28 Sep 2020 14:55:47 +0100
 Subject: [PATCH] export HYPERLINK target in html clipboard export
 Change-Id: Ia77e4bd8a5b54636d0e9e561360128202a81420b
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103557
 Tested-by: Jenkins
 Reviewed-by: Eike Rathke <erack@redhat.com>
 ---
 sc/source/filter/html/htmlexp.cxx | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 diff --git a/sc/source/filter/html/htmlexp.cxx b/sc/source/filter/html/htmlexp.cxx
 index 6122c9b6c45c..13792201c8b0 100644
 --- a/sc/source/filter/html/htmlexp.cxx
 +++ b/sc/source/filter/html/htmlexp.cxx
@@ -37,6 +37,7 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/frmhtmlw.hxx>
 #include <sfx2/objsh.hxx>
 +#include <svl/stritem.hxx>
 #include <svl/urihelper.hxx>
 #include <svtools/htmlkywd.hxx>
 #include <svtools/htmlout.hxx>
@@ -1127,6 +1128,26 @@ void ScHTMLExport::WriteCell( sc::ColumnBlockPosition& rBlockPos, SCCOL nCol, SC
         TAG_ON(aStr.makeStringAndClear().getStr());
     }
 +    OUString aURL;
 +    bool bWriteHyperLink(false);
 +    if (aCell.meType == CELLTYPE_FORMULA)
 +    {
 +        ScFormulaCell* pFCell = aCell.mpFormula;
 +        if (pFCell->IsHyperLinkCell())
 +        {
 +            OUString aCellText;
 +            pFCell->GetURLResult(aURL, aCellText);
 +            bWriteHyperLink = true;
 +        }
 +    }
 +
 +    if (bWriteHyperLink)
 +    {
 +        OString aURLStr = HTMLOutFuncs::ConvertStringToHTML(aURL, eDestEnc, &aNonConvertibleChars);
 +        OString aStr = OOO_STRING_SVTOOLS_HTML_anchor " " OOO_STRING_SVTOOLS_HTML_O_href "=\"" + aURLStr + "\"";
 +        TAG_ON(aStr.getStr());
 +    }
 +
     OUString aStrOut;
     bool bFieldText = false;
@@ -1174,6 +1195,8 @@ void ScHTMLExport::WriteCell( sc::ColumnBlockPosition& rBlockPos, SCCOL nCol, SC
     if ( pGraphEntry )
         WriteGraphEntry( pGraphEntry );
 +    if (bWriteHyperLink) { TAG_OFF(OOO_STRING_SVTOOLS_HTML_anchor); }
 +
     if ( bSetFont )     TAG_OFF( OOO_STRING_SVTOOLS_HTML_font );
     if ( bCrossedOut )  TAG_OFF( OOO_STRING_SVTOOLS_HTML_strikethrough );
     if ( bUnderline )   TAG_OFF( OOO_STRING_SVTOOLS_HTML_underline );
 -- 
 2.26.2
--- a/SOURCES/0001-fix-detecting-qrcodegen.patch
+++ b/SOURCES/0001-fix-detecting-qrcodegen.patch
@ -0,0 +1,40 @@
 From ddf72365b7e7c67b2580e328e55de6eb988b8787 Mon Sep 17 00:00:00 2001
 From: Thierry Vignaud <thierry.vignaud@gmail.com>
 Date: Thu, 30 Jan 2020 11:19:20 +0000
 Subject: [PATCH] fix detecting qrcodegen
 Change-Id: Ib945b57420083489273cefc5655eb50932b5a3f8
 ---
 configure.ac                           |    2 +-
 cui/source/dialogs/QrCodeGenDialog.cxx |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/configure.ac b/configure.ac
 index 388bee3..c061349 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -10092,7 +10092,7 @@ else
         AC_MSG_RESULT([external])
         SYSTEM_QRCODEGEN=TRUE
         AC_LANG_PUSH([C++])
 -        AC_CHECK_HEADER(qrcodegen/QrCode.hpp, [],
 +        AC_CHECK_HEADER(qrcodegencpp/QrCode.hpp, [],
             [AC_MSG_ERROR(qrcodegen headers not found.)], [#include <stdexcept>])
         AC_CHECK_LIB([qrcodegencpp], [main], [:],
             [ AC_MSG_ERROR(qrcodegen C++ library not found.) ], [])
 diff --git a/cui/source/dialogs/QrCodeGenDialog.cxx b/cui/source/dialogs/QrCodeGenDialog.cxx
 index 6277e76..f8dd327 100644
 --- a/cui/source/dialogs/QrCodeGenDialog.cxx
 +++ b/cui/source/dialogs/QrCodeGenDialog.cxx
@@ -20,7 +20,7 @@
 #if ENABLE_QRCODEGEN
 #if defined(SYSTEM_QRCODEGEN)
 -#include <qrcodegen/QrCode.hpp>
 +#include <qrcodegencpp/QrCode.hpp>
 #else
 #include <QrCode.hpp>
 #endif
 -- 
 2.26.2
--- a/SOURCES/0001-forcepoint-fix-out-of-bounds-read-in-ICU.patch
+++ b/SOURCES/0001-forcepoint-fix-out-of-bounds-read-in-ICU.patch
@ -1,74 +0,0 @@
 From 2b69156c43261ceae55eb4d3b644c4c2d73231ba Mon Sep 17 00:00:00 2001
 Message-Id: <2b69156c43261ceae55eb4d3b644c4c2d73231ba.1531843216.git.erack@redhat.com>
 From: David Tardon <dtardon@redhat.com>
 Date: Tue, 6 Mar 2018 15:17:13 +0100
 Subject: [PATCH] forcepoint: fix out-of-bounds read in ICU
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 Change-Id: I5061d38d0e7df0de9a5c7574d522ce69934e4a24
 ---
 external/icu/UnpackedTarball_icu.mk |  1 +
 external/icu/ofz4860.patch.2        | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 external/icu/ofz4860.patch.2
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0001-forcepoint-fix-out-of-bounds-read-in-ICU.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0001-forcepoint-fix-out-of-bounds-read-in-ICU.patch"
 diff --git a/external/icu/UnpackedTarball_icu.mk b/external/icu/UnpackedTarball_icu.mk
 index 499650976a55..a4d0b16ecb36 100644
 --- a/external/icu/UnpackedTarball_icu.mk
 +++ b/external/icu/UnpackedTarball_icu.mk
@@ -35,6 +35,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,icu,\
 	$(if $(filter-out ANDROID,$(OS)),external/icu/icu4c-icudata-stdlibs.patch.1) \
 	external/icu/icu4c-khmerbreakengine.patch.1 \
 	external/icu/icu4c-59-werror-shadow.patch.1 \
 +	external/icu/ofz4860.patch.2 \
 ))
 $(eval $(call gb_UnpackedTarball_add_file,icu,source/data/brkitr/khmerdict.dict,external/icu/khmerdict.dict))
 diff --git a/external/icu/ofz4860.patch.2 b/external/icu/ofz4860.patch.2
 new file mode 100644
 index 000000000000..14114d52878b
 --- /dev/null
 +++ b/external/icu/ofz4860.patch.2
@@ -0,0 +1,25 @@
 +From 529ba01ee606940ca273b187be8ce9ba31cf2d90 Mon Sep 17 00:00:00 2001
 +From: David Tardon <dtardon@redhat.com>
 +Date: Fri, 19 Jan 2018 10:41:02 +0100
 +Subject: [PATCH] ofz#4860 fix past-the-end read from array
 +
 +---
 + icu4c/source/common/locmap.cpp | 2 +-
 + 1 file changed, 1 insertion(+), 1 deletion(-)
 +
 +diff --git a/icu4c/source/common/locmap.cpp b/icu4c/source/common/locmap.cpp
 +index cbb2b810a..6d62d8310 100644
 +--- a/icu4c/source/common/locmap.cpp
 ++++ b/icu4c/source/common/locmap.cpp
 +@@ -1015,7 +1015,7 @@ static const char*
 + getPosixID(const ILcidPosixMap *this_0, uint32_t hostID)
 + {
 +     uint32_t i;
 +-    for (i = 0; i <= this_0->numRegions; i++)
 ++    for (i = 0; i < this_0->numRegions; i++)
 +     {
 +         if (this_0->regionMaps[i].hostID == hostID)
 +         {
 +-- 
 +2.14.3
 +
 --------------erAck-patch-parts--
--- a/SOURCES/0001-gtk3-only-for-3.20.patch
+++ b/SOURCES/0001-gtk3-only-for-3.20.patch
@ -1,26 +0,0 @@
 From cd928ec49d4bcf8f9736c3a07ccd1b3fd5df6ad8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 25 Sep 2017 11:20:34 +0100
 Subject: [PATCH] gtk3 only for >= 3.20
 Change-Id: I98008c0028ed5d85fe8770197078360de70010a8
 ---
 vcl/unx/gtk/gtkinst.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/vcl/unx/gtk/gtkinst.cxx b/vcl/unx/gtk/gtkinst.cxx
 index e01a267b..7237b6c 100644
 --- a/vcl/unx/gtk/gtkinst.cxx
 +++ b/vcl/unx/gtk/gtkinst.cxx
@@ -82,7 +82,7 @@ extern "C"
             XInitThreads();
 #if GTK_CHECK_VERSION(3,0,0)
 -        if (gtk_minor_version < 14)
 +        if (gtk_minor_version < 20)
         {
             g_warning("require a newer gtk than 3.%d for theme expectations", gtk_minor_version);
             return nullptr;
 -- 
 2.9.5
--- a/SOURCES/0001-implement-pdf-export-of-underline-for-outlined-font.patch
+++ b/SOURCES/0001-implement-pdf-export-of-underline-for-outlined-font.patch
@ -1,48 +0,0 @@
 From d01b115cb9db9200900f78d614d220b6bec1eb7d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 20 Jul 2018 14:49:17 +0100
 Subject: [PATCH] implement pdf export of underline for outlined font
 just the simplest case of a straight solid line which is outlined,
 i.e. border in font color and filled with white
 Change-Id: I7d670a543475b6457cb2827e74a05bba6c4a91ea
 ---
 vcl/source/gdi/pdfwriter_impl.cxx | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 diff --git a/vcl/source/gdi/pdfwriter_impl.cxx b/vcl/source/gdi/pdfwriter_impl.cxx
 index 58711a9d862b..bf932ad17ef8 100644
 --- a/vcl/source/gdi/pdfwriter_impl.cxx
 +++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -7384,6 +7384,27 @@ void PDFWriterImpl::drawStraightTextLine( OStringBuffer& aLine, long nWidth, Fon
     if ( !nLineHeight )
         return;
 +    // outline attribute ?
 +    if (m_aCurrentPDFState.m_aFont.IsOutline() && eTextLine == LINESTYLE_SINGLE)
 +    {
 +        appendStrokingColor(aColor, aLine); // stroke with text color
 +        aLine.append( " " );
 +        Color aNonStrokeColor(COL_WHITE);   // fill with white
 +        appendNonStrokingColor(aNonStrokeColor, aLine);
 +        aLine.append( "\n" );
 +        aLine.append( "0.25 w \n" ); // same line thickness as in drawLayout
 +
 +        // draw rectangle instead
 +        aLine.append( "0 " );
 +        m_aPages.back().appendMappedLength( static_cast<sal_Int32>(-nLinePos * 1.5), aLine );
 +        aLine.append( " " );
 +        m_aPages.back().appendMappedLength( static_cast<sal_Int32>(nWidth), aLine, false );
 +        aLine.append( ' ' );
 +        m_aPages.back().appendMappedLength( static_cast<sal_Int32>(nLineHeight), aLine );
 +        aLine.append( " re h B\n" );
 +        return;
 +    }
 +
     m_aPages.back().appendMappedLength( (sal_Int32)nLineHeight, aLine );
     aLine.append( " w " );
     appendStrokingColor( aColor, aLine );
 -- 
 2.17.0
--- a/SOURCES/0001-keep-pyuno-script-processing-below-base-uri.patch
+++ b/SOURCES/0001-keep-pyuno-script-processing-below-base-uri.patch
@ -1,70 +0,0 @@
 From 14c85889616de301e3a214c49fff2e6da3327d1f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 18 Oct 2018 20:39:23 +0100
 Subject: [PATCH] keep pyuno script processing below base uri
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: Icc13fb7193fb1e7c50e0df286161a10b4ed636c7
 Reviewed-on: https://gerrit.libreoffice.org/61970
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
 Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 ---
 scripting/source/pyprov/pythonscript.py | 30 +++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)
 diff --git a/scripting/source/pyprov/pythonscript.py b/scripting/source/pyprov/pythonscript.py
 index 4803d0bebc23..f5aa2173333a 100644
 --- a/scripting/source/pyprov/pythonscript.py
 +++ b/scripting/source/pyprov/pythonscript.py
@@ -25,6 +25,7 @@ import imp
 import time
 import ast
 import platform
 +from com.sun.star.uri.RelativeUriExcessParentSegments import RETAIN
 try:
     unicode
@@ -212,8 +213,33 @@ class MyUriHelper:
     def scriptURI2StorageUri( self, scriptURI ):
         try:
 -            myUri = self.m_uriRefFac.parse(scriptURI)
 -            ret = self.m_baseUri + "/" + myUri.getName().replace( "|", "/" )
 +            # base path to the python script location
 +            sBaseUri = self.m_baseUri + "/"
 +            xBaseUri = self.m_uriRefFac.parse(sBaseUri)
 +
 +            # path to the .py file + "$functionname, arguments, etc
 +            xStorageUri = self.m_uriRefFac.parse(scriptURI)
 +            sStorageUri = xStorageUri.getName().replace( "|", "/" );
 +
 +            # path to the .py file, relative to the base
 +            sFileUri = sStorageUri[0:sStorageUri.find("$")]
 +            xFileUri = self.m_uriRefFac.parse(sFileUri)
 +            if not xFileUri:
 +                message = "pythonscript: invalid relative uri '" + sFileUri+ "'"
 +                log.debug( message )
 +                raise RuntimeException( message )
 +
 +            # absolute path to the .py file
 +            xAbsScriptUri = self.m_uriRefFac.makeAbsolute(xBaseUri, xFileUri, True, RETAIN)
 +            sAbsScriptUri = xAbsScriptUri.getUriReference()
 +
 +            # ensure py file is under the base path
 +            if not sAbsScriptUri.startswith(sBaseUri):
 +                message = "pythonscript: storage uri '" + sAbsScriptUri + "' not in base uri '" + self.m_baseUri + "'"
 +                log.debug( message )
 +                raise RuntimeException( message )
 +
 +            ret = sBaseUri + sStorageUri
             log.debug( "converting scriptURI="+scriptURI + " to storageURI=" + ret )
             return ret
         except UnoException as e:
 -- 
 2.20.1
--- a/SOURCES/0001-munge-cmis-headers-to-remove-exception-specs.patch
+++ b/SOURCES/0001-munge-cmis-headers-to-remove-exception-specs.patch
--- a/SOURCES/0001-replace-Palatino-Linotype-with-Liberation-Serif.patch
+++ b/SOURCES/0001-replace-Palatino-Linotype-with-Liberation-Serif.patch
@ -0,0 +1,26 @@
 From 06b19641b0eac7b7992fae861eb4807397c9aee4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 28 Oct 2020 10:03:23 +0000
 Subject: [PATCH] replace 'Palatino Linotype' with 'Liberation Serif'
 for consistent font replacement
 Change-Id: I3c124c0adcab8ac2dd7f989c2fa5c97182e32b64
 ---
 sw/qa/extras/layout/data/forcepoint75-1.rtf | Bin 88740 -> 88738 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 diff --git a/sw/qa/extras/layout/data/forcepoint75-1.rtf b/sw/qa/extras/layout/data/forcepoint75-1.rtf
 index 01a52963757d8568e5ae8b80b7767c924c37a407..263a585c57e162caf1c9f9dd3aee4f3d8aa3edd2 100644
 GIT binary patch
 delta 85
 zcmZ3om37fp)(y#wVm_HksYQt;nfZAN!Kp==Y1XyXF=>XA=QD{5pi50&#At*e*!+}n
 M`%^~7{Sk~@09cV9Z2$lO
 delta 104
 zcmZ3qm37Hh)(y#w_5q1Gi6xnN`3gQjqNK7Q)w;GiCe1J=ttdY?F)t>$Al)D)Ejc5x
 ds5rI6KmkMb<OPgIf*7LBj~KT<Vr1MO0RTX3C};ox
 -- 
 2.26.2
--- a/SOURCES/0001-replace-boost-bimap-in-sdext-pdfimport.patch
+++ b/SOURCES/0001-replace-boost-bimap-in-sdext-pdfimport.patch
@ -0,0 +1,110 @@
 From 193b49763a03d63ba79db50c1fa0563ec0d6b0c3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 29 Jan 2020 12:44:52 +0000
 Subject: [PATCH] replace boost::bimap in sdext pdfimport
 Change-Id: Ie324a0b81931bbd427483878a87beeca455ada18
 ---
 sdext/source/pdfimport/inc/pdfiprocessor.hxx  | 12 ++++-------
 sdext/source/pdfimport/tree/pdfiprocessor.cxx | 21 +++++++++++--------
 2 files changed, 16 insertions(+), 17 deletions(-)
 diff --git a/sdext/source/pdfimport/inc/pdfiprocessor.hxx b/sdext/source/pdfimport/inc/pdfiprocessor.hxx
 index 89f9d601b7b0..9e08d6a6a765 100644
 --- a/sdext/source/pdfimport/inc/pdfiprocessor.hxx
 +++ b/sdext/source/pdfimport/inc/pdfiprocessor.hxx
@@ -37,9 +37,6 @@
 #include "treevisitorfactory.hxx"
 #include "genericelements.hxx"
 -#include <boost/bimap/bimap.hpp>
 -#include <boost/bimap/unordered_set_of.hpp>
 -
 namespace pdfi
 {
@@ -160,10 +157,8 @@ namespace pdfi
         typedef std::unordered_map<sal_Int32,FontAttributes> IdToFontMap;
         typedef std::unordered_map<FontAttributes,sal_Int32,FontAttrHash> FontToIdMap;
 -        typedef boost::bimaps::bimap<
 -                             boost::bimaps::unordered_set_of<GraphicsContext, GraphicsContextHash>,
 -                             boost::bimaps::unordered_set_of<sal_Int32>
 -                            > GCToIdBiMap;
 +        typedef std::unordered_map<sal_Int32,GraphicsContext> IdToGCMap;
 +        typedef std::unordered_map<GraphicsContext, sal_Int32, GraphicsContextHash> GCToIdMap;
         typedef std::vector<GraphicsContext> GraphicsContextStack;
@@ -178,7 +173,8 @@ namespace pdfi
         GraphicsContextStack               m_aGCStack;
         sal_Int32                          m_nNextGCId;
 -        GCToIdBiMap                        m_aGCToId;
 +        IdToGCMap                          m_aIdToGC;
 +        GCToIdMap                          m_aGCToId;
         ImageContainer                     m_aImages;
 diff --git a/sdext/source/pdfimport/tree/pdfiprocessor.cxx b/sdext/source/pdfimport/tree/pdfiprocessor.cxx
 index c6baa7fee8b2..ed2eaf6510b9 100644
 --- a/sdext/source/pdfimport/tree/pdfiprocessor.cxx
 +++ b/sdext/source/pdfimport/tree/pdfiprocessor.cxx
@@ -54,6 +54,7 @@ namespace pdfi
     m_aFontToId(),
     m_aGCStack(),
     m_nNextGCId( 1 ),
 +    m_aIdToGC(),
     m_aGCToId(),
     m_aImages(),
     m_nPages(0),
@@ -65,12 +66,13 @@ namespace pdfi
     aDefFont.isBold     = false;
     aDefFont.isItalic   = false;
     aDefFont.size       = 10*PDFI_OUTDEV_RESOLUTION/72;
 -    m_aIdToFont[ 0 ]    = aDefFont;
 -    m_aFontToId[ aDefFont ] = 0;
 +    m_aIdToFont.insert({0, aDefFont});
 +    m_aFontToId.insert({aDefFont, 0});
     GraphicsContext aDefGC;
     m_aGCStack.push_back( aDefGC );
 -    m_aGCToId.insert(GCToIdBiMap::relation(aDefGC, 0));
 +    m_aGCToId.insert({aDefGC, 0});
 +    m_aIdToGC.insert({0, aDefGC});
 }
 void PDFIProcessor::setPageNum( sal_Int32 nPages )
@@ -468,12 +470,13 @@ const FontAttributes& PDFIProcessor::getFont( sal_Int32 nFontId ) const
 sal_Int32 PDFIProcessor::getGCId( const GraphicsContext& rGC )
 {
     sal_Int32 nGCId = 0;
 -    auto it = m_aGCToId.left.find( rGC );
 -    if( it != m_aGCToId.left.end() )
 +    auto it = m_aGCToId.find( rGC );
 +    if( it != m_aGCToId.end() )
         nGCId = it->second;
     else
     {
 -        m_aGCToId.insert(GCToIdBiMap::relation(rGC, m_nNextGCId));
 +        m_aGCToId.insert({rGC, m_nNextGCId});
 +        m_aIdToGC.insert({m_nNextGCId, rGC});
         nGCId = m_nNextGCId;
         m_nNextGCId++;
     }
@@ -483,9 +486,9 @@ sal_Int32 PDFIProcessor::getGCId( const GraphicsContext& rGC )
 const GraphicsContext& PDFIProcessor::getGraphicsContext( sal_Int32 nGCId ) const
 {
 -    auto it = m_aGCToId.right.find( nGCId );
 -    if( it == m_aGCToId.right.end() )
 -        it = m_aGCToId.right.find( 0 );
 +    auto it = m_aIdToGC.find( nGCId );
 +    if( it == m_aIdToGC.end() )
 +        it = m_aIdToGC.find( 0 );
     return it->second;
 }
 -- 
 2.24.1
--- a/SOURCES/0001-request-installation-of-langpack-via-packagekit.patch
+++ b/SOURCES/0001-request-installation-of-langpack-via-packagekit.patch
@ -1,946 +0,0 @@
 From 44686bc81055c7bee7f41f9e219c35115ce8119f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 20 Dec 2017 15:29:39 +0000
 Subject: [PATCH] request installation of langpack via packagekit
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 if ui is set to track the locale automatically and the current locale
 has no match in installed resources but has a match in the list of
 languages that libreoffice was compiled to contain
 so e.g. de_AT locale shouldn't trigger the installation of anything if
 langpack-de is already installed and yue_HK shouldn't trigger install
 of anything cause that not supported (at time of writing) for libreoffice
 put Fedora/RHEL/Ubuntu naming schemes in here.
 I moved the lang code from svl to svtools so I could use the restart dialog
 to prompt to restart after the langpack is installed, but packagekit's blocking
 mode seems to be no longer blocking and control returns immediately which is a
 change since the last time I played with this stuff, so drop the restart thing
 for now. The lack of a blocking modal also makes the "run this on idle when there's
 a toplevel window up and running" a bit futile, but lets keep that for now anyway.
 also...
 set dbus id for existing DbusSessionHelper users
 Change-Id: I64329e21ae79b6607856de9781bee0274b9cb136
 Reviewed-on: https://gerrit.libreoffice.org/46854
 Tested-by: Jenkins <ci@libreoffice.org>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 7cf4eeed81fd333c87dedffa792f5d547b7981f0)
 Change-Id: Ice731be539850338ccdd8af87839e0b4d83f01e7
 ---
 config_host/config_langs.h.in                      |  10 ++
 config_host/config_vendor.h.in                     |  10 ++
 configure.ac                                       |   4 +
 cui/source/options/optgdlg.cxx                     |   3 +-
 desktop/source/app/langselect.cxx                  |   3 +-
 include/svl/languageoptions.hxx                    |   3 -
 include/svtools/langhelp.hxx                       |   3 +
 offapi/org/freedesktop/PackageKit/XModify.idl      |  22 ++--
 .../registry/data/org/openoffice/Office/Common.xcu |   3 +
 .../schema/org/openoffice/Office/Common.xcs        |   6 +
 sfx2/source/appl/appserv.cxx                       |   3 +-
 .../sessioninstall/SyncDbusSessionHelper.cxx       |  57 +++++----
 .../sessioninstall/SyncDbusSessionHelper.hxx       |  20 ++--
 svl/source/config/languageoptions.cxx              |  33 ------
 svtools/source/misc/langhelp.cxx                   | 130 ++++++++++++++++++++-
 sw/source/uibase/app/apphdl.cxx                    |   3 +-
 vcl/inc/unx/fontmanager.hxx                        |   6 +-
 vcl/unx/generic/fontmanager/fontconfig.cxx         |  93 ++-------------
 vcl/unx/generic/fontmanager/fontmanager.cxx        |   2 -
 19 files changed, 235 insertions(+), 179 deletions(-)
 create mode 100644 config_host/config_langs.h.in
 create mode 100644 config_host/config_vendor.h.in
 diff --git a/config_host/config_langs.h.in b/config_host/config_langs.h.in
 new file mode 100644
 index 0000000..d60a5c1
 --- /dev/null
 +++ b/config_host/config_langs.h.in
@@ -0,0 +1,10 @@
 +/* Configuration of restriction on supported ui languages, by the
 + * --with-lang option.
 + */
 +
 +#ifndef CONFIG_LANGS_H
 +#define CONFIG_LANGS_H
 +
 +#define WITH_LANG ""
 +
 +#endif
 diff --git a/config_host/config_vendor.h.in b/config_host/config_vendor.h.in
 new file mode 100644
 index 0000000..3260221
 --- /dev/null
 +++ b/config_host/config_vendor.h.in
@@ -0,0 +1,10 @@
 +/* Configuration of restriction on supported ui languages, by the
 + * --with-lang option.
 + */
 +
 +#ifndef CONFIG_VENDOR_H
 +#define CONFIG_VENDOR_H
 +
 +#define OOO_VENDOR ""
 +
 +#endif
 diff --git a/configure.ac b/configure.ac
 index bbb47e6..55e2aa0 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -11777,6 +11777,7 @@ if test "$enable_release_build" = "" -o "$enable_release_build" = "no"; then
     ALL_LANGS=`echo $ALL_LANGS qtz`
 fi
 AC_SUBST(ALL_LANGS)
 +AC_DEFINE_UNQUOTED(WITH_LANG,"$WITH_LANG")
 AC_SUBST(WITH_LANG)
 AC_SUBST(WITH_LANG_LIST)
 AC_SUBST(GIT_NEEDED_SUBMODULES)
@@ -11925,6 +11926,7 @@ else
     OOO_VENDOR="$with_vendor"
     AC_MSG_RESULT([$OOO_VENDOR])
 fi
 +AC_DEFINE_UNQUOTED(OOO_VENDOR,"$OOO_VENDOR")
 AC_SUBST(OOO_VENDOR)
 if test "$_os" = "Android" ; then
@@ -12538,6 +12540,7 @@ AC_CONFIG_HEADERS([config_host/config_gio.h])
 AC_CONFIG_HEADERS([config_host/config_global.h])
 AC_CONFIG_HEADERS([config_host/config_gpgme.h])
 AC_CONFIG_HEADERS([config_host/config_java.h])
 +AC_CONFIG_HEADERS([config_host/config_langs.h])
 AC_CONFIG_HEADERS([config_host/config_lgpl.h])
 AC_CONFIG_HEADERS([config_host/config_liblangtag.h])
 AC_CONFIG_HEADERS([config_host/config_locales.h])
@@ -12549,6 +12552,7 @@ AC_CONFIG_HEADERS([config_host/config_options.h])
 AC_CONFIG_HEADERS([config_host/config_options_calc.h])
 AC_CONFIG_HEADERS([config_host/config_test.h])
 AC_CONFIG_HEADERS([config_host/config_typesizes.h])
 +AC_CONFIG_HEADERS([config_host/config_vendor.h])
 AC_CONFIG_HEADERS([config_host/config_vcl.h])
 AC_CONFIG_HEADERS([config_host/config_vclplug.h])
 AC_CONFIG_HEADERS([config_host/config_version.h])
 diff --git a/cui/source/options/optgdlg.cxx b/cui/source/options/optgdlg.cxx
 index 1c90931..7965179 100644
 --- a/cui/source/options/optgdlg.cxx
 +++ b/cui/source/options/optgdlg.cxx
@@ -21,6 +21,7 @@
 #include <svl/zforlist.hxx>
 #include <svl/currencytable.hxx>
 #include <svtools/grfmgr.hxx>
 +#include <svtools/langhelp.hxx>
 #include <svl/flagitem.hxx>
 #include <sfx2/dispatch.hxx>
 #include <unotools/lingucfg.hxx>
@@ -1122,7 +1123,7 @@ namespace
     LanguageTag GetInstalledLocaleForSystemUILanguage()
     {
         css::uno::Sequence<OUString> inst(officecfg::Setup::Office::InstalledLocales::get()->getElementNames());
 -        return LanguageTag(getInstalledLocaleForSystemUILanguage(inst)).makeFallback();
 +        return LanguageTag(getInstalledLocaleForSystemUILanguage(inst, false)).makeFallback();
     }
 }
 diff --git a/desktop/source/app/langselect.cxx b/desktop/source/app/langselect.cxx
 index 4ce877a..86ce743 100644
 --- a/desktop/source/app/langselect.cxx
 +++ b/desktop/source/app/langselect.cxx
@@ -37,6 +37,7 @@
 #include <sal/log.hxx>
 #include <sal/types.h>
 #include <svl/languageoptions.hxx>
 +#include <svtools/langhelp.hxx>
 #include <app.hxx>
@@ -103,7 +104,7 @@ bool prepareLocale() {
         }
     }
     if (locale.isEmpty()) {
 -        locale = getInstalledLocaleForSystemUILanguage(inst);
 +        locale = getInstalledLocaleForSystemUILanguage(inst, true);
     }
     if (locale.isEmpty()) {
         return false;
 diff --git a/include/svl/languageoptions.hxx b/include/svl/languageoptions.hxx
 index f386cb6..6de8eb5 100644
 --- a/include/svl/languageoptions.hxx
 +++ b/include/svl/languageoptions.hxx
@@ -131,9 +131,6 @@ public:
     bool            isCJKKeyboardLayoutInstalled() const;
 };
 -OUString SVL_DLLPUBLIC getInstalledLocaleForLanguage(css::uno::Sequence<OUString> const & installed, OUString const & locale);
 -OUString SVL_DLLPUBLIC getInstalledLocaleForSystemUILanguage(css::uno::Sequence<OUString> const & installed);
 -
 #endif // INCLUDED_SVL_LANGUAGEOPTIONS_HXX
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/include/svtools/langhelp.hxx b/include/svtools/langhelp.hxx
 index a3a84df..db22bb3 100644
 --- a/include/svtools/langhelp.hxx
 +++ b/include/svtools/langhelp.hxx
@@ -22,6 +22,9 @@
  */
 SVT_DLLPUBLIC void localizeWebserviceURI( OUString& io_rURI );
 +OUString SVT_DLLPUBLIC getInstalledLocaleForLanguage(css::uno::Sequence<OUString> const & installed, OUString const & locale);
 +OUString SVT_DLLPUBLIC getInstalledLocaleForSystemUILanguage(css::uno::Sequence<OUString> const & installed, bool bRequestInstallIfMissing);
 +
 #endif
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/offapi/org/freedesktop/PackageKit/XModify.idl b/offapi/org/freedesktop/PackageKit/XModify.idl
 index a712bb5..69544e9 100644
 --- a/offapi/org/freedesktop/PackageKit/XModify.idl
 +++ b/offapi/org/freedesktop/PackageKit/XModify.idl
@@ -22,7 +22,7 @@ module PackageKit
  *  The interface used for modifying the package database.
  *
  * @sa
 - * https://git.gnome.org/browse/gnome-software/tree/src/org.freedesktop.PackageKit.xml
 + * https://git.gnome.org/browse/gnome-software/tree/src/org.freedesktop.PackageKit.Modify2.xml
  * for documentation of the corresponding D-Bus interface
  */
 interface XModify : com::sun::star::uno::XInterface
@@ -32,70 +32,70 @@ interface XModify : com::sun::star::uno::XInterface
      * @since LibreOffice 4.0
      */
 -    void InstallPackageFiles( [in] unsigned long xid, [in] sequence< string > files, [in] string interaction);
 +    void InstallPackageFiles([in] sequence< string > files, [in] string interaction);
     /**
      * Installs sequence< string > packages to provide sequence< string > files.
      * @since LibreOffice 4.0
      */
 -    void InstallProvideFiles( [in] unsigned long xid, [in] sequence< string > files, [in] string interaction);
 +    void InstallProvideFiles([in] sequence< string > files, [in] string interaction);
     /**
      * Installs sequence< string > packages to provide sequence< string > files.
      * @since LibreOffice 4.0
      */
 -    void InstallCatalogs( [in] unsigned long xid, [in] sequence< string > files, [in] string interaction);
 +    void InstallCatalogs([in] sequence< string > files, [in] string interaction);
     /**
      * Installs sequence< string > packages from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallPackageNames( [in] unsigned long xid, [in] sequence< string > packages, [in] string interaction);
 +    void InstallPackageNames([in] sequence< string > packages, [in] string interaction);
     /**
      * Installs mimetype handlers from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallMimeTypes( [in] unsigned long xid, [in] sequence< string > mimeTypes, [in] string interaction);
 +    void InstallMimeTypes([in] sequence< string > mimeTypes, [in] string interaction);
     /**
      * Installs fontconfig resources ( [in] usually fonts) from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallFontconfigResources( [in] unsigned long xid, [in] sequence< string > resources, [in] string interaction);
 +    void InstallFontconfigResources([in] sequence< string > resources, [in] string interaction);
     /**
      * Installs GStreamer resources ( [in] usually codecs) from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallGStreamerResources( [in] unsigned long xid, [in] sequence< string > resources, [in] string interaction);
 +    void InstallGStreamerResources([in] sequence< string > resources, [in] string interaction);
     /**
      * Installs resources of a given type from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallResources( [in] unsigned long xid, [in] sequence< string > types, [in] sequence< string > resources, [in] string interaction);
 +    void InstallResources([in] sequence< string > types, [in] sequence< string > resources, [in] string interaction);
     /**
      * Removes sequence< string > packages that provide the given local sequence< string > files.
      * @since LibreOffice 4.0
      */
 -    void RemovePackageByFiles( [in] unsigned long xid, [in] sequence< string > files, [in] string interaction);
 +    void RemovePackageByFiles([in] sequence< string > files, [in] string interaction);
     /**
      * Installs printer drivers from a configured software source.
      * @since LibreOffice 4.0
      */
 -    void InstallPrinterDrivers( [in] unsigned long xid, [in] sequence< string > files, [in] string interaction);
 +    void InstallPrinterDrivers([in] sequence< string > files, [in] string interaction);
 };
 } ; // PackageKit
 diff --git a/officecfg/registry/data/org/openoffice/Office/Common.xcu b/officecfg/registry/data/org/openoffice/Office/Common.xcu
 index 6b94ff9..26d1ba0 100644
 --- a/officecfg/registry/data/org/openoffice/Office/Common.xcu
 +++ b/officecfg/registry/data/org/openoffice/Office/Common.xcu
@@ -535,6 +535,9 @@
       <prop oor:name="EnableFontInstallation" oor:type="xs:boolean">
         <value install:module="unx">true</value>
       </prop>
 +      <prop oor:name="EnableLangpackInstallation" oor:type="xs:boolean">
 +        <value install:module="unx">true</value>
 +      </prop>
   </node>
   <node oor:name="Classification">
       <prop oor:name="Policy" oor:type="xs:short">
 diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 index f9816fc..2884179 100644
 --- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 +++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
@@ -6382,6 +6382,12 @@
         </info>
         <value>true</value>
       </prop>
 +      <prop oor:name="EnableLangpackInstallation" oor:type="xs:boolean" oor:nillable="false">
 +        <info>
 +           <desc>Specifies if missing langpack installation should be triggered.</desc>
 +        </info>
 +        <value>true</value>
 +      </prop>
     </group>
     <group oor:name="Classification">
       <info>
 diff --git a/sfx2/source/appl/appserv.cxx b/sfx2/source/appl/appserv.cxx
 index 1e2a2ec..e48e5aa 100644
 --- a/sfx2/source/appl/appserv.cxx
 +++ b/sfx2/source/appl/appserv.cxx
@@ -59,6 +59,7 @@
 #include <unotools/configmgr.hxx>
 #include <tools/diagnose_ex.h>
 #include <vcl/layout.hxx>
 +#include <vcl/sysdata.hxx>
 #include <svl/intitem.hxx>
 #include <svl/eitem.hxx>
 #include <svl/stritem.hxx>
@@ -196,7 +197,7 @@ namespace
                 using namespace svtools;
                 Reference< XSyncDbusSessionHelper > xSyncDbusSessionHelper(SyncDbusSessionHelper::create(comphelper::getProcessComponentContext()));
                 Sequence< OUString > vPackages { "libreoffice-base" };
 -                xSyncDbusSessionHelper->InstallPackageNames(0, vPackages, OUString());
 +                xSyncDbusSessionHelper->InstallPackageNames(vPackages, OUString());
                 // Ill be back (hopefully)!
                 SolarMutexGuard aGuard;
                 executeRestartDialog(comphelper::getProcessComponentContext(), nullptr, RESTART_REASON_BIBLIOGRAPHY_INSTALL);
 diff --git a/shell/source/sessioninstall/SyncDbusSessionHelper.cxx b/shell/source/sessioninstall/SyncDbusSessionHelper.cxx
 index a1211f7..1938077 100644
 --- a/shell/source/sessioninstall/SyncDbusSessionHelper.cxx
 +++ b/shell/source/sessioninstall/SyncDbusSessionHelper.cxx
@@ -18,7 +18,7 @@ using namespace ::com::sun::star::uno;
 namespace
 {
 -    struct GVariantDeleter { void operator()(GVariant* pV) { g_variant_unref(pV); } };
 +    struct GVariantDeleter { void operator()(GVariant* pV) { if (pV) g_variant_unref(pV); } };
     struct GVariantBuilderDeleter { void operator()(GVariantBuilder* pVB) { g_variant_builder_unref(pVB); } };
     template <typename T> struct GObjectDeleter { void operator()(T* pO) { g_object_unref(pO); } };
     class GErrorWrapper
@@ -55,8 +55,15 @@ namespace
         return proxy;
     }
 +    static GVariant* pk_make_platform_data()
 +    {
 +        GVariantBuilder builder;
 +        g_variant_builder_init(&builder, G_VARIANT_TYPE("a{sv}"));
 +        return g_variant_builder_end(&builder);
 +    }
 +
 void request(
 -    char const * method, sal_uInt32 xid,
 +    char const * method,
     css::uno::Sequence<OUString> const & resources,
     OUString const & interaction)
 {
@@ -70,14 +77,14 @@ void request(
     }
     auto iactUtf8(OUStringToOString(interaction, RTL_TEXTENCODING_UTF8));
     std::shared_ptr<GDBusProxy> proxy(
 -        lcl_GetPackageKitProxy("Modify"), GObjectDeleter<GDBusProxy>());
 +        lcl_GetPackageKitProxy("Modify2"), GObjectDeleter<GDBusProxy>());
     GErrorWrapper error;
 -    g_dbus_proxy_call_sync(
 +    std::shared_ptr<GVariant> result(g_dbus_proxy_call_sync(
         proxy.get(), method,
         g_variant_new(
 -            "(uass)", static_cast<guint32>(xid), builder.get(),
 -            iactUtf8.getStr()),
 -        G_DBUS_CALL_FLAGS_NONE, -1, nullptr, &error.getRef());
 +            "(asss@a{sv})", builder.get(), iactUtf8.getStr(),
 +            "libreoffice-startcenter.desktop", pk_make_platform_data()),
 +        G_DBUS_CALL_FLAGS_NONE, -1, nullptr, &error.getRef()), GVariantDeleter());
 }
 }
@@ -92,66 +99,66 @@ namespace shell { namespace sessioninstall
     }
 void SyncDbusSessionHelper::InstallPackageFiles(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & files,
 +    css::uno::Sequence<OUString> const & files,
     OUString const & interaction)
 {
 -    request("InstallPackageFiles", xid, files, interaction);
 +    request("InstallPackageFiles", files, interaction);
 }
 void SyncDbusSessionHelper::InstallProvideFiles(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & files,
 +    css::uno::Sequence<OUString> const & files,
     OUString const & interaction)
 {
 -    request("InstallProvideFiles", xid, files, interaction);
 +    request("InstallProvideFiles", files, interaction);
 }
 void SyncDbusSessionHelper::InstallCatalogs(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & files,
 +    css::uno::Sequence<OUString> const & files,
     OUString const & interaction)
 {
 -    request("InstallCatalogs", xid, files, interaction);
 +    request("InstallCatalogs", files, interaction);
 }
 void SyncDbusSessionHelper::InstallPackageNames(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & packages,
 +    css::uno::Sequence<OUString> const & packages,
     OUString const & interaction)
 {
 -    request("InstallPackageNames", xid, packages, interaction);
 +    request("InstallPackageNames", packages, interaction);
 }
 void SyncDbusSessionHelper::InstallMimeTypes(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & mimeTypes,
 +    css::uno::Sequence<OUString> const & mimeTypes,
     OUString const & interaction)
 {
 -    request("InstallMimeTypes", xid, mimeTypes, interaction);
 +    request("InstallMimeTypes", mimeTypes, interaction);
 }
 void SyncDbusSessionHelper::InstallFontconfigResources(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & resources,
 +    css::uno::Sequence<OUString> const & resources,
     OUString const & interaction)
 {
 -    request("InstallFontconfigResources", xid, resources, interaction);
 +    request("InstallFontconfigResources", resources, interaction);
 }
 void SyncDbusSessionHelper::InstallGStreamerResources(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & resources,
 +    css::uno::Sequence<OUString> const & resources,
     OUString const & interaction)
 {
 -    request("InstallGStreamerResources", xid, resources, interaction);
 +    request("InstallGStreamerResources", resources, interaction);
 }
 void SyncDbusSessionHelper::RemovePackageByFiles(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & files,
 +    css::uno::Sequence<OUString> const & files,
     OUString const & interaction)
 {
 -    request("RemovePackageByFiles", xid, files, interaction);
 +    request("RemovePackageByFiles", files, interaction);
 }
 void SyncDbusSessionHelper::InstallPrinterDrivers(
 -    sal_uInt32 xid, css::uno::Sequence<OUString> const & files,
 +    css::uno::Sequence<OUString> const & files,
     OUString const & interaction)
 {
 -    request("InstallPrinteDrivers", xid, files, interaction);
 +    request("InstallPrinteDrivers", files, interaction);
 }
     void SAL_CALL SyncDbusSessionHelper::IsInstalled( const OUString& sPackagename, const OUString& sInteraction, sal_Bool& o_isInstalled )
 diff --git a/shell/source/sessioninstall/SyncDbusSessionHelper.hxx b/shell/source/sessioninstall/SyncDbusSessionHelper.hxx
 index 731b649..72b17ba 100644
 --- a/shell/source/sessioninstall/SyncDbusSessionHelper.hxx
 +++ b/shell/source/sessioninstall/SyncDbusSessionHelper.hxx
@@ -23,26 +23,26 @@ namespace shell { namespace sessioninstall
             SyncDbusSessionHelper(css::uno::Reference< css::uno::XComponentContext> const&);
             // XModify Methods
 -            virtual void SAL_CALL InstallPackageFiles( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallPackageFiles( const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallProvideFiles( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallProvideFiles( const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallCatalogs( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallCatalogs( const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallPackageNames( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& packages, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallPackageNames( const css::uno::Sequence< OUString >& packages, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallMimeTypes( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& mimeTypes, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallMimeTypes( const css::uno::Sequence< OUString >& mimeTypes, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallFontconfigResources( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& resources, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallFontconfigResources( const css::uno::Sequence< OUString >& resources, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallGStreamerResources( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& resources, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallGStreamerResources( const css::uno::Sequence< OUString >& resources, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallResources( ::sal_uInt32 /* xid */, const css::uno::Sequence< OUString >& /* types */, const css::uno::Sequence< OUString >& /* resources */, const OUString& /* interaction */ ) override
 +            virtual void SAL_CALL InstallResources( const css::uno::Sequence< OUString >& /* types */, const css::uno::Sequence< OUString >& /* resources */, const OUString& /* interaction */ ) override
                 { throw css::uno::RuntimeException(); } // not implemented
 -            virtual void SAL_CALL RemovePackageByFiles( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 +            virtual void SAL_CALL RemovePackageByFiles( const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 -            virtual void SAL_CALL InstallPrinterDrivers( ::sal_uInt32 xid, const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
 +            virtual void SAL_CALL InstallPrinterDrivers( const css::uno::Sequence< OUString >& files, const OUString& interaction ) override;
             // XQuery Methods
             virtual void SAL_CALL IsInstalled( const OUString& /* package_name */, const OUString& /* interaction */, sal_Bool& /* installed */ ) override;
 diff --git a/svl/source/config/languageoptions.cxx b/svl/source/config/languageoptions.cxx
 index 9f9fe45..74af031 100644
 --- a/svl/source/config/languageoptions.cxx
 +++ b/svl/source/config/languageoptions.cxx
@@ -27,7 +27,6 @@
 #include <rtl/instance.hxx>
 #include <com/sun/star/i18n/ScriptType.hpp>
 #include <unotools/syslocale.hxx>
 -#include <officecfg/System.hxx>
 #ifdef _WIN32
 #if !defined WIN32_LEAN_AND_MEAN
@@ -256,41 +255,9 @@ bool SvtSystemLanguageOptions::isKeyboardLayoutTypeInstalled(sal_Int16 scriptTyp
     return isInstalled;
 }
 -
 bool SvtSystemLanguageOptions::isCJKKeyboardLayoutInstalled() const
 {
     return isKeyboardLayoutTypeInstalled(css::i18n::ScriptType::ASIAN);
 }
 -OUString getInstalledLocaleForLanguage(css::uno::Sequence<OUString> const & installed, OUString const & locale)
 -{
 -    if (locale.isEmpty())
 -        return OUString();  // do not attempt to resolve anything
 -
 -    for (sal_Int32 i = 0; i != installed.getLength(); ++i) {
 -        if (installed[i] == locale) {
 -            return installed[i];
 -        }
 -    }
 -    std::vector<OUString> fallbacks(LanguageTag(locale).getFallbackStrings(false));
 -    for (OUString & rf : fallbacks) {
 -        for (sal_Int32 i = 0; i != installed.getLength(); ++i) {
 -            if (installed[i] == rf) {
 -                return installed[i];
 -            }
 -        }
 -    }
 -    return OUString();
 -}
 -
 -OUString getInstalledLocaleForSystemUILanguage(const css::uno::Sequence<OUString>& rLocaleElementNames)
 -{
 -    OUString locale = getInstalledLocaleForLanguage(rLocaleElementNames, officecfg::System::L10N::UILocale::get());
 -    if (locale.isEmpty())
 -        locale = getInstalledLocaleForLanguage(rLocaleElementNames, "en-US");
 -    if (locale.isEmpty() && rLocaleElementNames.hasElements())
 -        locale = rLocaleElementNames[0];
 -    return locale;
 -}
 -
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/svtools/source/misc/langhelp.cxx b/svtools/source/misc/langhelp.cxx
 index 16a3a1d..1e4c5c5 100644
 --- a/svtools/source/misc/langhelp.cxx
 +++ b/svtools/source/misc/langhelp.cxx
@@ -7,12 +7,20 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 -
 +#include <comphelper/sequence.hxx>
 +#include <i18nlangtag/mslangid.hxx>
 +#include <officecfg/Office/Common.hxx>
 +#include <officecfg/System.hxx>
 +#include <org/freedesktop/PackageKit/SyncDbusSessionHelper.hpp>
 +#include <rtl/ustring.hxx>
 #include <svtools/langhelp.hxx>
 -
 +#include <vcl/idle.hxx>
 #include <vcl/svapp.hxx>
 +#include <vcl/sysdata.hxx>
 #include <vcl/settings.hxx>
 -#include <rtl/ustring.hxx>
 +#include <vcl/window.hxx>
 +#include <config_langs.h>
 +#include <config_vendor.h>
 void localizeWebserviceURI( OUString& rURI )
 {
@@ -33,4 +41,120 @@ void localizeWebserviceURI( OUString& rURI )
     rURI += aLang;
 }
 +OUString getInstalledLocaleForLanguage(css::uno::Sequence<OUString> const & installed, OUString const & locale)
 +{
 +    if (locale.isEmpty())
 +        return OUString();  // do not attempt to resolve anything
 +
 +    for (sal_Int32 i = 0; i != installed.getLength(); ++i) {
 +        if (installed[i] == locale) {
 +            return installed[i];
 +        }
 +    }
 +    std::vector<OUString> fallbacks(LanguageTag(locale).getFallbackStrings(false));
 +    for (OUString & rf : fallbacks) {
 +        for (sal_Int32 i = 0; i != installed.getLength(); ++i) {
 +            if (installed[i] == rf) {
 +                return installed[i];
 +            }
 +        }
 +    }
 +    return OUString();
 +}
 +
 +static std::unique_ptr<Idle> xLangpackInstaller;
 +
 +class InstallLangpack : public Idle
 +{
 +    std::vector<OUString> m_aPackages;
 +public:
 +    explicit InstallLangpack(const std::vector<OUString>& rPackages)
 +        : Idle("install langpack")
 +        , m_aPackages(rPackages)
 +    {
 +        SetPriority(TaskPriority::LOWEST);
 +    }
 +
 +    virtual void Invoke() override
 +    {
 +        vcl::Window* pTopWindow = Application::GetActiveTopWindow();
 +        if (!pTopWindow)
 +            pTopWindow = Application::GetFirstTopLevelWindow();
 +        if (!pTopWindow)
 +        {
 +            Start();
 +            return;
 +        }
 +        try
 +        {
 +            using namespace org::freedesktop::PackageKit;
 +            css::uno::Reference<XSyncDbusSessionHelper> xSyncDbusSessionHelper(SyncDbusSessionHelper::create(comphelper::getProcessComponentContext()));
 +            xSyncDbusSessionHelper->InstallPackageNames(comphelper::containerToSequence(m_aPackages), OUString());
 +        }
 +        catch (const css::uno::Exception& e)
 +        {
 +            SAL_INFO("svl", "trying to install a LibreOffice langpack, caught " << e);
 +        }
 +        xLangpackInstaller.reset();
 +    }
 +};
 +
 +OUString getInstalledLocaleForSystemUILanguage(const css::uno::Sequence<OUString>& rLocaleElementNames, bool bRequestInstallIfMissing)
 +{
 +    OUString wantedLocale = officecfg::System::L10N::UILocale::get();
 +    OUString locale = getInstalledLocaleForLanguage(rLocaleElementNames, wantedLocale);
 +    if (bRequestInstallIfMissing && locale.isEmpty() && !wantedLocale.isEmpty() && !Application::IsHeadlessModeEnabled() &&
 +        officecfg::Office::Common::PackageKit::EnableLangpackInstallation::get())
 +    {
 +        LanguageTag aWantedTag(wantedLocale);
 +        if (aWantedTag.getLanguage() != "en")
 +        {
 +            // We try these bases + the exact locale + fallback locale.
 +            //
 +            // The theory is that we can request a bunch of packages
 +            // and it's a success if one of them is available
 +            std::vector<OUString> aPackages;
 +            OUString sAvailableLocales(WITH_LANG);
 +            std::vector<OUString> aAvailable;
 +            sal_Int32 nIndex = 0;
 +            do
 +            {
 +                aAvailable.emplace_back(sAvailableLocales.getToken(0, ' ', nIndex));
 +            }
 +            while (nIndex >= 0);
 +            OUString install = getInstalledLocaleForLanguage(comphelper::containerToSequence(aAvailable), wantedLocale);
 +            if (!install.isEmpty() && install != "en-US")
 +            {
 +                if (strcmp(OOO_VENDOR, "Red Hat, Inc.") == 0 || strcmp(OOO_VENDOR, "The Fedora Project") == 0)
 +                {
 +                    // langpack is the typical Fedora/RHEL naming convention
 +                    LanguageType eType = aWantedTag.getLanguageType();
 +                    if (MsLangId::isSimplifiedChinese(eType))
 +                        aPackages.emplace_back("libreoffice-langpack-zh-Hans");
 +                    else if (MsLangId::isTraditionalChinese(eType))
 +                        aPackages.emplace_back("libreoffice-langpack-zh-Hant");
 +                    else
 +                        aPackages.emplace_back("libreoffice-langpack-" + install);
 +                }
 +                //Debian would be: "The Document Foundation/Debian"
 +                else if (strcmp(OOO_VENDOR, "The Document Foundation, Debian and Ubuntu") == 0)
 +                {
 +                    // l10n is the typical Debian/Ubuntu naming convention
 +                    aPackages.emplace_back("libreoffice-l10n-" + install);
 +                }
 +            }
 +            if (!aPackages.empty())
 +            {
 +                xLangpackInstaller.reset(new InstallLangpack(aPackages));
 +                xLangpackInstaller->Start();
 +            }
 +        }
 +    }
 +    if (locale.isEmpty())
 +        locale = getInstalledLocaleForLanguage(rLocaleElementNames, "en-US");
 +    if (locale.isEmpty() && rLocaleElementNames.hasElements())
 +        locale = rLocaleElementNames[0];
 +    return locale;
 +}
 +
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/sw/source/uibase/app/apphdl.cxx b/sw/source/uibase/app/apphdl.cxx
 index 467112e..6986807 100644
 --- a/sw/source/uibase/app/apphdl.cxx
 +++ b/sw/source/uibase/app/apphdl.cxx
@@ -44,6 +44,7 @@
 #include <svl/ctloptions.hxx>
 #include <unotools/useroptions.hxx>
 #include <vcl/msgbox.hxx>
 +#include <vcl/sysdata.hxx>
 #include <vcl/wrkwin.hxx>
 #include <svx/insctrl.hxx>
 #include <svx/selctrl.hxx>
@@ -420,7 +421,7 @@ void SwMailMergeWizardExecutor::ExecuteMailMergeWizard( const SfxItemSet * pArgs
             using namespace svtools;
             css::uno::Reference< XSyncDbusSessionHelper > xSyncDbusSessionHelper(SyncDbusSessionHelper::create(comphelper::getProcessComponentContext()));
             const css::uno::Sequence< OUString > vPackages{ "libreoffice-base" };
 -            xSyncDbusSessionHelper->InstallPackageNames(0, vPackages, OUString());
 +            xSyncDbusSessionHelper->InstallPackageNames(vPackages, OUString());
             SolarMutexGuard aGuard;
             executeRestartDialog(comphelper::getProcessComponentContext(), nullptr, RESTART_REASON_MAILMERGE_INSTALL);
         }
 diff --git a/vcl/inc/unx/fontmanager.hxx b/vcl/inc/unx/fontmanager.hxx
 index 03d033e..14aebde 100644
 --- a/vcl/inc/unx/fontmanager.hxx
 +++ b/vcl/inc/unx/fontmanager.hxx
@@ -192,14 +192,10 @@ class VCL_PLUGIN_PUBLIC PrintFontManager
     static void addFontconfigDir(const OString& rDirectory);
     std::set<OString> m_aPreviousLangSupportRequests;
 -#if ENABLE_GIO
 -    std::vector<OString> m_aCurrentRequests;
 -#endif
 +    std::vector<OUString> m_aCurrentRequests;
     Timer m_aFontInstallerTimer;
 -#if ENABLE_GIO
     DECL_LINK( autoInstallFontLangSupport, Timer*, void );
 -#endif
     PrintFontManager();
 public:
     ~PrintFontManager();
 diff --git a/vcl/unx/generic/fontmanager/fontconfig.cxx b/vcl/unx/generic/fontmanager/fontconfig.cxx
 index 2c16e04..59acfa5 100644
 --- a/vcl/unx/generic/fontmanager/fontconfig.cxx
 +++ b/vcl/unx/generic/fontmanager/fontconfig.cxx
@@ -20,6 +20,7 @@
 #include <memory>
 #include <unx/fontmanager.hxx>
 #include <impfont.hxx>
 +#include <comphelper/sequence.hxx>
 #include <vcl/svapp.hxx>
 #include <vcl/sysdata.hxx>
 #include <vcl/vclenum.hxx>
@@ -31,8 +32,8 @@
 #include <rtl/strbuf.hxx>
 #include <unicode/uchar.h>
 #include <unicode/uscript.h>
 -#include <config_gio.h>
 #include <officecfg/Office/Common.hxx>
 +#include <org/freedesktop/PackageKit/SyncDbusSessionHelper.hpp>
 using namespace psp;
@@ -40,10 +41,6 @@ using namespace psp;
 #include <ft2build.h>
 #include <fontconfig/fcfreetype.h>
 -#if ENABLE_GIO
 -#include <gio/gio.h>
 -#endif
 -
 #include <cstdio>
 #include <cstdarg>
@@ -862,96 +859,28 @@ namespace
             aBuf.append('-').append(pScriptCode);
         return OStringToOUString(aBuf.makeStringAndClear(), RTL_TEXTENCODING_UTF8);
     }
 -
 -#if ENABLE_GIO
 -    guint get_xid_for_dbus()
 -    {
 -        // FIXME: Application::GetActiveTopWindow only returns something sensible if LO currently has the focus
 -        // (which is not the case when you are trying to debug this...). It should instead return the last active window.
 -        const vcl::Window *pTopWindow = Application::IsHeadlessModeEnabled() ? nullptr : Application::GetActiveTopWindow();
 -        const SystemEnvData* pEnvData = pTopWindow ? pTopWindow->GetSystemData() : nullptr;
 -        return pEnvData ? pEnvData->aWindow : 0;
 -    }
 -#endif
 }
 -#if ENABLE_GIO
 IMPL_LINK_NOARG(PrintFontManager, autoInstallFontLangSupport, Timer *, void)
 {
 -    if (!officecfg::Office::Common::PackageKit::EnableFontInstallation::get())
 -        return;
 -
 -    guint xid = get_xid_for_dbus();
 -
 -    if (!xid)
 +    try
     {
 -        SAL_WARN("vcl", "Could not retrieve X Window ID for DBUS");
 -        return;
 +        using namespace org::freedesktop::PackageKit;
 +        css::uno::Reference<XSyncDbusSessionHelper> xSyncDbusSessionHelper(SyncDbusSessionHelper::create(comphelper::getProcessComponentContext()));
 +        xSyncDbusSessionHelper->InstallFontconfigResources(comphelper::containerToSequence(m_aCurrentRequests), "hide-finished");
     }
 -
 -
 -    GError *error = nullptr;
 -    /* get the DBUS session connection */
 -    GDBusConnection *session_connection = g_bus_get_sync(G_BUS_TYPE_SESSION, nullptr, &error);
 -    if (error != nullptr)
 -    {
 -        g_debug ("DBUS cannot connect : %s", error->message);
 -        g_error_free (error);
 -        return;
 -    }
 -
 -    /* get the proxy with gnome-session-manager */
 -    GDBusProxy *proxy = g_dbus_proxy_new_sync(session_connection,
 -                                              G_DBUS_PROXY_FLAGS_NONE,
 -                                              nullptr, // GDBusInterfaceInfo
 -                                              "org.freedesktop.PackageKit",
 -                                              "/org/freedesktop/PackageKit",
 -                                              "org.freedesktop.PackageKit.Modify",
 -                                              nullptr, // GCancellable
 -                                              &error);
 -    if (proxy == nullptr && error != nullptr)
 -    {
 -        g_debug("Could not get DBUS proxy: org.freedesktop.PackageKit: %s", error->message);
 -        g_error_free(error);
 -        return;
 -    }
 -
 -    GVariantBuilder *builder = g_variant_builder_new (G_VARIANT_TYPE("as")); // 'as'=array of strings
 -    for (std::vector<OString>::const_iterator aI = m_aCurrentRequests.begin(); aI != m_aCurrentRequests.end(); ++aI)
 -        g_variant_builder_add (builder, "s", aI->getStr());
 -
 -    GVariant *res = g_dbus_proxy_call_sync(proxy,
 -                                     "InstallFontconfigResources",
 -                                     // Create a new variant with the following types:
 -                                     //   'u'=guint32 (xid); 'as'=array of strings (builder); 's'=string ("hide-finished")
 -                                     // See also https://people.gnome.org/~ryanl/glib-docs/gvariant-format-strings.html
 -                                     g_variant_new("(uass)", xid, builder, "hide-finished"),
 -                                     G_DBUS_CALL_FLAGS_NONE,
 -                                     -1, // Timeout
 -                                     nullptr, // GCancellable
 -                                     &error);
 -
 -    if (res == nullptr && error != nullptr)
 +    catch (const css::uno::Exception& e)
     {
 +        SAL_INFO("vcl", "InstallFontconfigResources problem, caught " << e);
         // Disable this method from now on. It's simply not available on some systems
         // and leads to an error dialog being shown each time this is called tdf#104883
         std::shared_ptr<comphelper::ConfigurationChanges> batch( comphelper::ConfigurationChanges::create() );
         officecfg::Office::Common::PackageKit::EnableFontInstallation::set(false, batch);
         batch->commit();
 -        g_debug("InstallFontconfigResources problem : %s", error->message);
 -        g_error_free(error);
 -    }
 -    else
 -    {
 -        g_variant_unref(res);
     }
 -    g_variant_builder_unref(builder);
 -    g_object_unref(G_OBJECT (proxy));
 -
     m_aCurrentRequests.clear();
 }
 -#endif
 void PrintFontManager::Substitute( FontSelectPattern &rPattern, OUString& rMissingCodes )
 {
@@ -1107,8 +1036,7 @@ void PrintFontManager::Substitute( FontSelectPattern &rPattern, OUString& rMissi
                     }
                 }
                 OUString sStillMissing(pRemainingCodes.get(), nRemainingLen);
 -#if ENABLE_GIO
 -                if (get_xid_for_dbus())
 +                if (!Application::IsHeadlessModeEnabled() && officecfg::Office::Common::PackageKit::EnableFontInstallation::get())
                 {
                     if (sStillMissing == rMissingCodes) //replaced nothing
                     {
@@ -1127,7 +1055,7 @@ void PrintFontManager::Substitute( FontSelectPattern &rPattern, OUString& rMissi
                             if (!sTag.isEmpty() && m_aPreviousLangSupportRequests.find(sTag) == m_aPreviousLangSupportRequests.end())
                             {
                                 OString sReq = OString(":lang=") + sTag;
 -                                m_aCurrentRequests.push_back(sReq);
 +                                m_aCurrentRequests.push_back(OUString::fromUtf8(sReq));
                                 m_aPreviousLangSupportRequests.insert(sTag);
                             }
                         }
@@ -1138,7 +1066,6 @@ void PrintFontManager::Substitute( FontSelectPattern &rPattern, OUString& rMissi
                         m_aFontInstallerTimer.Start();
                     }
                 }
 -#endif
                 rMissingCodes = sStillMissing;
             }
         }
 diff --git a/vcl/unx/generic/fontmanager/fontmanager.cxx b/vcl/unx/generic/fontmanager/fontmanager.cxx
 index c956345..d1743dd 100644
 --- a/vcl/unx/generic/fontmanager/fontmanager.cxx
 +++ b/vcl/unx/generic/fontmanager/fontmanager.cxx
@@ -146,10 +146,8 @@ PrintFontManager::PrintFontManager()
     : m_nNextFontID( 1 )
     , m_nNextDirAtom( 1 )
 {
 -#if ENABLE_GIO
     m_aFontInstallerTimer.SetInvokeHandler(LINK(this, PrintFontManager, autoInstallFontLangSupport));
     m_aFontInstallerTimer.SetTimeout(5000);
 -#endif
 }
 PrintFontManager::~PrintFontManager()
 -- 
 2.9.5
--- a/SOURCES/0001-rhbz-1691287-tdf-53029-ui-prompt-for-printer-authent.patch
+++ b/SOURCES/0001-rhbz-1691287-tdf-53029-ui-prompt-for-printer-authent.patch
@ -1,352 +0,0 @@
 From f1df94c1415302792d31ce4b6e28b7eb93d769fd Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 26 Mar 2019 12:09:03 +0000
 Subject: [PATCH] rhbz#1691287 tdf#53029 ui prompt for printer authentication
 refactor and reuse existing dialog to add potential domain entry
 Change-Id: Ib884931f8ccc62aad9b3e92ecf93d1da7ffe607b
 ---
 vcl/inc/printerinfomanager.hxx        |   2 +
 vcl/uiconfig/ui/cupspassworddialog.ui |  34 +++-
 vcl/unx/generic/printer/cupsmgr.cxx   | 221 ++++++++++++++++++--------
 3 files changed, 183 insertions(+), 74 deletions(-)
 diff --git a/vcl/inc/printerinfomanager.hxx b/vcl/inc/printerinfomanager.hxx
 index 7691fbeebc6c..4c225a22f91e 100644
 --- a/vcl/inc/printerinfomanager.hxx
 +++ b/vcl/inc/printerinfomanager.hxx
@@ -52,6 +52,8 @@ struct PrinterInfo : JobData
     // a list of special features separated by ',' not used by psprint
     // but assigned from the outside (currently for "fax","pdf=","autoqueue","external_dialog")
     OUString             m_aFeatures;
 +    // auth-info-required, potential [domain],[username],[password] to prompt for to authenticate printing
 +    OUString             m_aAuthInfoRequired;
     bool                 m_bPapersizeFromSetup;
     PrinterInfo()
 diff --git a/vcl/uiconfig/ui/cupspassworddialog.ui b/vcl/uiconfig/ui/cupspassworddialog.ui
 index f4fb757209bb..2c17d1397c3e 100644
 --- a/vcl/uiconfig/ui/cupspassworddialog.ui
 +++ b/vcl/uiconfig/ui/cupspassworddialog.ui
@@ -73,7 +73,7 @@
               </object>
               <packing>
                 <property name="left_attach">0</property>
 -                <property name="top_attach">1</property>
 +                <property name="top_attach">2</property>
               </packing>
             </child>
             <child>
@@ -87,7 +87,7 @@
               </object>
               <packing>
                 <property name="left_attach">0</property>
 -                <property name="top_attach">2</property>
 +                <property name="top_attach">3</property>
               </packing>
             </child>
             <child>
@@ -114,7 +114,7 @@
               </object>
               <packing>
                 <property name="left_attach">1</property>
 -                <property name="top_attach">1</property>
 +                <property name="top_attach">2</property>
               </packing>
             </child>
             <child>
@@ -123,10 +123,36 @@
                 <property name="can_focus">True</property>
                 <property name="hexpand">True</property>
                 <property name="visibility">False</property>
 +                <property name="input_purpose">password</property>
               </object>
               <packing>
                 <property name="left_attach">1</property>
 -                <property name="top_attach">2</property>
 +                <property name="top_attach">3</property>
 +              </packing>
 +            </child>
 +            <child>
 +              <object class="GtkLabel" id="label3">
 +                <property name="can_focus">False</property>
 +                <property name="no_show_all">True</property>
 +                <property name="label" translatable="yes" context="cupspassworddialog|label1">_Domain:</property>
 +                <property name="use_underline">True</property>
 +                <property name="mnemonic_widget">domain</property>
 +                <property name="xalign">1</property>
 +              </object>
 +              <packing>
 +                <property name="left_attach">0</property>
 +                <property name="top_attach">1</property>
 +              </packing>
 +            </child>
 +            <child>
 +              <object class="GtkEntry" id="domain">
 +                <property name="can_focus">True</property>
 +                <property name="no_show_all">True</property>
 +                <property name="hexpand">True</property>
 +              </object>
 +              <packing>
 +                <property name="left_attach">1</property>
 +                <property name="top_attach">1</property>
               </packing>
             </child>
           </object>
 diff --git a/vcl/unx/generic/printer/cupsmgr.cxx b/vcl/unx/generic/printer/cupsmgr.cxx
 index 328e9246e9f5..c872bde70dcf 100644
 --- a/vcl/unx/generic/printer/cupsmgr.cxx
 +++ b/vcl/unx/generic/printer/cupsmgr.cxx
@@ -319,6 +319,8 @@ void CUPSManager::initialize()
                 aPrinter.m_aInfo.m_aComment=OStringToOUString(pDest->options[k].value, aEncoding);
             if(!strcmp(pDest->options[k].name, "printer-location"))
                 aPrinter.m_aInfo.m_aLocation=OStringToOUString(pDest->options[k].value, aEncoding);
 +            if(!strcmp(pDest->options[k].name, "auth-info-required"))
 +                aPrinter.m_aInfo.m_aAuthInfoRequired=OStringToOUString(pDest->options[k].value, aEncoding);
         }
         OUStringBuffer aBuf( 256 );
@@ -617,6 +619,106 @@ void CUPSManager::getOptionsFromDocumentSetup( const JobData& rJob, bool bBanner
     }
 }
 +namespace
 +{
 +    class RTSPWDialog : public ModalDialog
 +    {
 +        VclPtr<FixedText> m_xText;
 +        VclPtr<FixedText> m_xDomainLabel;
 +        VclPtr<Edit> m_xDomainEdit;
 +        VclPtr<FixedText> m_xUserLabel;
 +        VclPtr<Edit> m_xUserEdit;
 +        VclPtr<FixedText> m_xPassLabel;
 +        VclPtr<Edit> m_xPassEdit;
 +
 +    public:
 +        RTSPWDialog(vcl::Window* pParent, const OString& rServer, const OString& rUserName);
 +        virtual void dispose() override;
 +        virtual ~RTSPWDialog() override;
 +
 +        OString getDomain() const
 +        {
 +            return OUStringToOString( m_xDomainEdit->GetText(), osl_getThreadTextEncoding() );
 +        }
 +
 +        OString getUserName() const
 +        {
 +            return OUStringToOString( m_xUserEdit->GetText(), osl_getThreadTextEncoding() );
 +        }
 +
 +        OString getPassword() const
 +        {
 +            return OUStringToOString( m_xPassEdit->GetText(), osl_getThreadTextEncoding() );
 +        }
 +
 +        void SetDomainVisible(bool bShow)
 +        {
 +            m_xDomainLabel->Show(bShow);
 +            m_xDomainEdit->Show(bShow);
 +        }
 +
 +        void SetUserVisible(bool bShow)
 +        {
 +            m_xUserLabel->Show(bShow);
 +            m_xUserEdit->Show(bShow);
 +        }
 +
 +        void SetPassVisible(bool bShow)
 +        {
 +            m_xPassLabel->Show(bShow);
 +            m_xPassEdit->Show(bShow);
 +        }
 +    };
 +
 +    RTSPWDialog::RTSPWDialog(vcl::Window* pParent, const OString& rServer, const OString& rUserName)
 +        : ModalDialog(pParent, "CUPSPasswordDialog", "vcl/ui/cupspassworddialog.ui")
 +    {
 +        get(m_xText, "text");
 +        get(m_xDomainLabel, "label3");
 +        get(m_xUserLabel, "label1");
 +        get(m_xUserEdit, "user");
 +        get(m_xPassLabel, "label2");
 +        get(m_xPassEdit, "pass");
 +
 +        OUString aText(m_xText->GetText());
 +        aText = aText.replaceFirst("%s", OStringToOUString(rServer, osl_getThreadTextEncoding()));
 +        m_xText->SetText(aText);
 +        m_xUserEdit->SetText(OStringToOUString(rUserName, osl_getThreadTextEncoding()));
 +    }
 +
 +    RTSPWDialog::~RTSPWDialog()
 +    {
 +        disposeOnce();
 +    }
 +
 +    void RTSPWDialog::dispose()
 +    {
 +        m_xText.clear();
 +        m_xDomainLabel.clear();
 +        m_xDomainEdit.clear();
 +        m_xUserLabel.clear();
 +        m_xUserEdit.clear();
 +        m_xPassLabel.clear();
 +        m_xPassEdit.clear();
 +        ModalDialog::dispose();
 +    }
 +
 +    bool AuthenticateQuery(const OString& rServer, OString& rUserName, OString& rPassword)
 +    {
 +        bool bRet = false;
 +
 +        ScopedVclPtrInstance<RTSPWDialog> aDialog(nullptr, rServer, rUserName);
 +        if (aDialog->Execute())
 +        {
 +            rUserName = aDialog->getUserName();
 +            rPassword = aDialog->getPassword();
 +            bRet = true;
 +        }
 +
 +        return bRet;
 +    }
 +}
 +
 bool CUPSManager::endSpool( const OUString& rPrintername, const OUString& rJobTitle, FILE* pFile, const JobData& rDocumentJobData, bool bBanner, const OUString& rFaxNumber )
 {
     SAL_INFO( "vcl.unx.print", "endSpool: " << rPrintername << "," << rJobTitle << " copy count = " << rDocumentJobData.m_nCopies );
@@ -642,7 +744,55 @@ bool CUPSManager::endSpool( const OUString& rPrintername, const OUString& rJobTi
         // setup cups options
         int nNumOptions = 0;
         cups_option_t* pOptions = nullptr;
 -        getOptionsFromDocumentSetup( rDocumentJobData, bBanner, nNumOptions, reinterpret_cast<void**>(&pOptions) );
 +        auto ppOptions = reinterpret_cast<void**>(&pOptions);
 +        getOptionsFromDocumentSetup( rDocumentJobData, bBanner, nNumOptions, ppOptions );
 +
 +        PrinterInfo aInfo(getPrinterInfo(rPrintername));
 +        if (!aInfo.m_aAuthInfoRequired.isEmpty())
 +        {
 +            bool bDomain(false), bUser(false), bPass(false);
 +            sal_Int32 nIndex = 0;
 +            do
 +            {
 +                OUString aToken = aInfo.m_aAuthInfoRequired.getToken(0, ',', nIndex);
 +                if (aToken == "domain")
 +                    bDomain = true;
 +                else if (aToken == "username")
 +                    bUser = true;
 +                else if (aToken == "password")
 +                    bPass = true;
 +            }
 +            while (nIndex >= 0);
 +
 +            if (bDomain || bUser || bPass)
 +            {
 +                OString sPrinterName(OUStringToOString(rPrintername, RTL_TEXTENCODING_UTF8));
 +                RTSPWDialog aDialog(nullptr, sPrinterName, "");
 +                aDialog.SetDomainVisible(bDomain);
 +                aDialog.SetUserVisible(bUser);
 +                aDialog.SetPassVisible(bPass);
 +
 +                if (aDialog.Execute() == RET_OK)
 +                {
 +                    OString sAuth;
 +                    if (bDomain)
 +                        sAuth = aDialog.getDomain().replaceAll(",", "\\,");
 +                    if (bUser)
 +                    {
 +                        if (!sAuth.isEmpty())
 +                            sAuth += ",";
 +                        sAuth += aDialog.getUserName().replaceAll(",", "\\,");
 +                    }
 +                    if (bPass)
 +                    {
 +                        if (!sAuth.isEmpty())
 +                            sAuth += ",";
 +                        sAuth += aDialog.getPassword().replaceAll(",", "\\,");
 +                    }
 +                    nNumOptions = cupsAddOption("auth-info", sAuth.getStr(), nNumOptions, &pOptions);
 +                }
 +            }
 +        }
         OString sJobName(OUStringToOString(rJobTitle, aEnc));
@@ -825,75 +975,6 @@ bool CUPSManager::writePrinterConfig()
     return PrinterInfoManager::writePrinterConfig();
 }
 -namespace
 -{
 -    class RTSPWDialog : public ModalDialog
 -    {
 -        VclPtr<FixedText> m_pText;
 -        VclPtr<Edit>      m_pUserEdit;
 -        VclPtr<Edit>      m_pPassEdit;
 -
 -    public:
 -        RTSPWDialog(const OString& rServer, const OString& rUserName, vcl::Window* pParent);
 -        virtual ~RTSPWDialog() override;
 -        virtual void dispose() override;
 -        OString getUserName() const;
 -        OString getPassword() const;
 -    };
 -
 -    RTSPWDialog::RTSPWDialog( const OString& rServer, const OString& rUserName, vcl::Window* pParent )
 -        : ModalDialog(pParent, "CUPSPasswordDialog",
 -            "vcl/ui/cupspassworddialog.ui")
 -    {
 -        get(m_pText, "text");
 -        get(m_pUserEdit, "user");
 -        get(m_pPassEdit, "pass");
 -
 -        OUString aText(m_pText->GetText());
 -        aText = aText.replaceFirst("%s", OStringToOUString(rServer, osl_getThreadTextEncoding()));
 -        m_pText->SetText(aText);
 -        m_pUserEdit->SetText( OStringToOUString(rUserName, osl_getThreadTextEncoding()));
 -    }
 -
 -    RTSPWDialog::~RTSPWDialog()
 -    {
 -        disposeOnce();
 -    }
 -
 -    void RTSPWDialog::dispose()
 -    {
 -        m_pText.clear();
 -        m_pUserEdit.clear();
 -        m_pPassEdit.clear();
 -        ModalDialog::dispose();
 -    }
 -
 -    OString RTSPWDialog::getUserName() const
 -    {
 -        return OUStringToOString( m_pUserEdit->GetText(), osl_getThreadTextEncoding() );
 -    }
 -
 -    OString RTSPWDialog::getPassword() const
 -    {
 -        return OUStringToOString( m_pPassEdit->GetText(), osl_getThreadTextEncoding() );
 -    }
 -
 -    bool AuthenticateQuery(const OString& rServer, OString& rUserName, OString& rPassword)
 -    {
 -        bool bRet = false;
 -
 -        ScopedVclPtrInstance<RTSPWDialog> aDialog(rServer, rUserName, nullptr);
 -        if (aDialog->Execute())
 -        {
 -            rUserName = aDialog->getUserName();
 -            rPassword = aDialog->getPassword();
 -            bRet = true;
 -        }
 -
 -        return bRet;
 -    }
 -}
 -
 const char* CUPSManager::authenticateUser()
 {
     const char* pRet = nullptr;
 -- 
 2.21.0
--- a/SOURCES/0001-rhbz-1870501-crash-on-reexport-of-odg.patch
+++ b/SOURCES/0001-rhbz-1870501-crash-on-reexport-of-odg.patch
--- a/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
+++ b/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
@ -0,0 +1,82 @@
 From 8bfdd84ffcffe19aa6c495a0772e1a5fcb9a5124 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 25 Sep 2020 11:22:03 +0100
 Subject: [PATCH] rhbz#1882616 move cursor one step at a time in the desired
 direction
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 until we get to the target position. The break iterator operates in graphemes
 so we can't just move Left/Right the amount of utf-16 we want to move.
 Change-Id: I25d4e9285deae374f85dcaadbf4601bc213a89de
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103380
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit bf858622e543163a23db766912ea6b121f447e6d)
 ---
 sw/source/core/edit/editsh.cxx | 40 +++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)
 diff --git a/sw/source/core/edit/editsh.cxx b/sw/source/core/edit/editsh.cxx
 index 8f84ce42ed75..872d92d7afcc 100644
 --- a/sw/source/core/edit/editsh.cxx
 +++ b/sw/source/core/edit/editsh.cxx
@@ -988,7 +988,8 @@ OUString SwEditShell::DeleteExtTextInput( bool bInsText )
 void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
 {
 -    const SwPosition& rPos = *GetCursor()->GetPoint();
 +    SwPaM* pCurrentCursor = GetCursor();
 +    const SwPosition& rPos = *pCurrentCursor->GetPoint();
     SwExtTextInput* pInput = GetDoc()->GetExtTextInput( rPos.nNode.GetNode() );
     if( !pInput )
         return;
@@ -1005,10 +1006,39 @@ void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
     // ugly but works
     ShowCursor();
     const sal_Int32 nDiff = nNewCursorPos - rPos.nContent.GetIndex();
 -    if( 0 > nDiff )
 -        Left( -nDiff, CRSR_SKIP_CHARS );
 -    else if( 0 < nDiff )
 -        Right( nDiff, CRSR_SKIP_CHARS );
 +    if( nDiff != 0)
 +    {
 +        bool bLeft = nDiff < 0;
 +        sal_Int32 nMaxGuard = std::abs(nDiff);
 +        while (true)
 +        {
 +            auto nOldPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
 +            if (bLeft)
 +                Left(1, CRSR_SKIP_CHARS);
 +            else
 +                Right(1, CRSR_SKIP_CHARS);
 +            auto nNewPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
 +
 +            // expected success
 +            if (nNewPos == nNewCursorPos)
 +                break;
 +
 +            if (nNewPos == nOldPos)
 +            {
 +                // if there was no movement, we have failed for some reason
 +                SAL_WARN("sw.core", "IM cursor move failed");
 +                break;
 +            }
 +
 +            if (--nMaxGuard == 0)
 +            {
 +                // if it takes more cursor moves than there are utf-16 chars to move past
 +                // something has probably gone wrong
 +                SAL_WARN("sw.core", "IM abandoning cursor positioning");
 +                break;
 +            }
 +        }
 +    }
     SetOverwriteCursor( rData.IsCursorOverwrite() );
 -- 
 2.29.2
--- a/SOURCES/0001-rhbz-1891326-suggest-package-install-of-the-most-app.patch
+++ b/SOURCES/0001-rhbz-1891326-suggest-package-install-of-the-most-app.patch
@ -0,0 +1,27 @@
 From 3f4885f3012132e915031461036a76e693489652 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Sun, 25 Oct 2020 20:39:50 +0000
 Subject: [PATCH] rhbz#1891326 suggest package install of the most appropiate
 pt langpack
 Change-Id: I87ff1a941a3a5dc0c321440a9c286ae73c9d0384
 ---
 svtools/source/misc/langhelp.cxx | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/svtools/source/misc/langhelp.cxx b/svtools/source/misc/langhelp.cxx
 index e64a3b869076..acaf2c6e24f3 100644
 --- a/svtools/source/misc/langhelp.cxx
 +++ b/svtools/source/misc/langhelp.cxx
@@ -139,6 +139,8 @@ OUString getInstalledLocaleForSystemUILanguage(const css::uno::Sequence<OUString
                         aPackages.emplace_back("libreoffice-langpack-zh-Hans");
                     else if (MsLangId::isTraditionalChinese(eType))
                         aPackages.emplace_back("libreoffice-langpack-zh-Hant");
 +                    else if (install == "pt")
 +                        aPackages.emplace_back("libreoffice-langpack-pt-PT");
                     else
                         aPackages.emplace_back("libreoffice-langpack-" + install);
                 }
 -- 
 2.26.2
--- a/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
+++ b/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
@ -0,0 +1,491 @@
 From b49380bd288e642352cb7ddc1c050e2fb34b5b43 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 13 Jul 2021 12:38:07 +0100
 Subject: [PATCH] rhbz#1980800 allow --convert-to csv to write each sheet to a
 separate file
 Related: tdf#135762 except only currently implemented for command line use
 sample usage:
 soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,-1 sample.ods
 where the new (11th!) final token ("-1") enables writing each sheet to a
 new file based on the suggested target name so output in this example
 is files sample-Sheet1.csv and sample-Sheet2.csv
 Only -1 for 'all sheets' vs 0 for existing 'current sheet only' (which
 is always sheet 0 from the command line) are currently options but the
 token could be expanded in the future to select specific sheets to
 export.
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118850
 Tested-by: Jenkins
 Reviewed-by: Eike Rathke <erack@redhat.com>
 (cherry picked from commit b8903bc106dad036acb3d117e5c4fc955697fe02)
 Related: tdf#135762 Allow --convert-to csv to specify 1-based sheet number
 Same multifile mechanism as for -1 all sheets is used, so
 soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,2 sample.ods
 writes a file sample-Sheet2.csv
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118971
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit fda91f8be16ba760e360940ebafd6244c648cb8c)
 Related: tdf#135762 Suppress cout if not command line
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119294
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit 0cda081c9aa3b3dcb363f97bac60c845ce9a13e0)
 Change-Id: Ib99a120f1a2c8d1008a7a3c59a6b39f572fb346e
 b9248c9561e4e340c88458ac5dfd159e443a4cfd
 9431221aadf97739bb197871f25fa151ef4c391c
 Plus follow-up fix
 <https://git.libreoffice.org/core/+/d768757872ad25219fa291acd623ab98924acaaa%5E%21>
 "tdf#129829 sfx2: fix handling of password to open vs modify" (which happens to
 also fix saving to smb shares, in addition to the Windows-specific issue it was
 originally meant to fix), plus the relevant parts of its preceding
 <https://git.libreoffice.org/core/+/037cd13af81f8a1169d01e95036ed942f261f9a6%5E%21>
 "sw reqif-xhtml export: add a new RTFOLEMimeType parameter" introducing
 SfxMedium::SetArgs.
 ---
 desktop/source/app/dispatchwatcher.cxx |  50 +++++++--
 include/sfx2/docfile.hxx               |   2 +
 sc/source/ui/dbgui/imoptdlg.cxx        |  16 ++-
 sc/source/ui/docshell/docsh.cxx        | 141 +++++++++++++++++++++----
 sc/source/ui/inc/docsh.hxx             |   2 +-
 sc/source/ui/inc/imoptdlg.hxx          |   6 +-
 sfx2/source/doc/docfile.cxx            |  13 +++
 7 files changed, 194 insertions(+), 36 deletions(-)
 diff --git a/desktop/source/app/dispatchwatcher.cxx b/desktop/source/app/dispatchwatcher.cxx
 index 04140173c6d1..a5365da618e8 100644
 --- a/desktop/source/app/dispatchwatcher.cxx
 +++ b/desktop/source/app/dispatchwatcher.cxx
@@ -30,6 +30,7 @@
 #include "dispatchwatcher.hxx"
 #include <rtl/ustring.hxx>
 #include <comphelper/processfactory.hxx>
 +#include <comphelper/string.hxx>
 #include <comphelper/synchronousdispatch.hxx>
 #include <com/sun/star/io/IOException.hpp>
 #include <com/sun/star/util/XCloseable.hpp>
@@ -604,6 +605,8 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
                                 aFilter = impl_GuessFilter( aOutFile, aDocService );
                             }
 +                            bool bMultiFileTarget = false;
 +
                             if (aFilter.isEmpty())
                             {
                                 std::cerr << "Error: no export filter" << std::endl;
@@ -611,29 +614,54 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
                             else
                             {
                                 sal_Int32 nFilterOptionsIndex = aFilter.indexOf(':');
 -                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 3 : 2;
 +                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 4 : 3;
                                 if ( !aImgOut.isEmpty() )
                                     nProps +=1;
                                 Sequence<PropertyValue> conversionProperties( nProps );
 -                                conversionProperties[0].Name = "Overwrite";
 -                                conversionProperties[0].Value <<= true;
 +                                conversionProperties[0].Name = "ConversionRequestOrigin";
 +                                conversionProperties[0].Value <<= OUString("CommandLine");
 +                                conversionProperties[1].Name = "Overwrite";
 +                                conversionProperties[1].Value <<= true;
 -                                conversionProperties[1].Name = "FilterName";
 +                                conversionProperties[2].Name = "FilterName";
                                 if( 0 < nFilterOptionsIndex )
                                 {
 -                                    conversionProperties[1].Value <<= aFilter.copy(0, nFilterOptionsIndex);
 +                                    OUString sFilterName = aFilter.copy(0, nFilterOptionsIndex);
 +                                    OUString sFilterOptions = aFilter.copy(nFilterOptionsIndex + 1);
 +
 +                                    if (sFilterName == "Text - txt - csv (StarCalc)")
 +                                    {
 +                                        sal_Int32 nIdx(0);
 +                                        // If the 11th token is '-1' then we export a file
 +                                        // per sheet where the file name is based on the suggested
 +                                        // output filename concatenated with the sheet name, so adjust
 +                                        // the output and overwrite messages
 +                                        // If the 11th token is not present or numeric 0 then the
 +                                        // default sheet is exported with the output filename. If it
 +                                        // is numeric >0 then that sheet (1-based) with the output
 +                                        // filename concatenated with the sheet name. So even if
 +                                        // that is a single file, the multi file target mechanism is
 +                                        // used.
 +                                        const OUString aTok(sFilterOptions.getToken(11, ',', nIdx));
 +                                        // Actual validity is checked in Calc, here just check for
 +                                        // presence of numeric value at start.
 +                                        bMultiFileTarget = (!aTok.isEmpty() && aTok.toInt32() != 0);
 +                                    }
 +
 +                                    conversionProperties[2].Value <<= sFilterName;
 -                                    conversionProperties[2].Name = "FilterOptions";
 -                                    conversionProperties[2].Value <<= aFilter.copy(nFilterOptionsIndex + 1);
 +                                    conversionProperties[3].Name = "FilterOptions";
 +                                    conversionProperties[3].Value <<= sFilterOptions;
                                 }
                                 else
                                 {
 -                                    conversionProperties[1].Value <<= aFilter;
 +                                    conversionProperties[2].Value <<= aFilter;
                                 }
                                 if ( !aImgOut.isEmpty() )
                                 {
 +                                    assert(conversionProperties[nProps-1].Name.isEmpty());
                                     conversionProperties[nProps-1].Name = "ImageFilter";
                                     conversionProperties[nProps-1].Value <<= aImgOut;
                                 }
@@ -645,9 +673,11 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
                                 OString aTargetURL8 = OUStringToOString(aTempName, osl_getThreadTextEncoding());
                                 if (aDispatchRequest.aRequestType != REQUEST_CAT)
                                 {
 -                                    std::cout << "convert " << aSource8 << " -> " << aTargetURL8;
 +                                    std::cout << "convert " << aSource8;
 +                                    if (!bMultiFileTarget)
 +                                        std::cout << " -> " << aTargetURL8;
                                     std::cout << " using filter : " << OUStringToOString(aFilter, osl_getThreadTextEncoding()) << std::endl;
 -                                    if (FStatHelper::IsDocument(aOutFile))
 +                                    if (!bMultiFileTarget && FStatHelper::IsDocument(aOutFile))
                                         std::cout << "Overwriting: " << OUStringToOString(aTempName, osl_getThreadTextEncoding()) << std::endl ;
                                 }
                                 try
 diff --git a/include/sfx2/docfile.hxx b/include/sfx2/docfile.hxx
 index 2019b5738c01..2886348 100644
 --- a/include/sfx2/docfile.hxx
 +++ b/include/sfx2/docfile.hxx
@@ -108,6 +108,8 @@ public:
     const OUString&     GetOrigURL() const;
     SfxItemSet  *       GetItemSet() const;
 +    void SetArgs(const css::uno::Sequence<css::beans::PropertyValue>& rArgs);
 +    css::uno::Sequence<css::beans::PropertyValue> GetArgs() const;
     void                Close(bool bInDestruction = false);
     void                CloseAndRelease();
     void                ReOpen();
 diff --git a/sc/source/ui/dbgui/imoptdlg.cxx b/sc/source/ui/dbgui/imoptdlg.cxx
 index 26781924baac..7aa8c8acb061 100644
 --- a/sc/source/ui/dbgui/imoptdlg.cxx
 +++ b/sc/source/ui/dbgui/imoptdlg.cxx
@@ -20,6 +20,7 @@
 #include <imoptdlg.hxx>
 #include <asciiopt.hxx>
 #include <comphelper/string.hxx>
 +#include <unotools/charclass.hxx>
 #include <osl/thread.h>
 #include <global.hxx>
@@ -43,6 +44,7 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
     bSaveNumberAsSuch = true;
     bSaveFormulas = false;
     bRemoveSpace = false;
 +    nSheetToExport = 0;
     sal_Int32 nTokenCount = comphelper::string::getTokenCount(rStr, ',');
     if ( nTokenCount >= 3 )
     {
@@ -76,6 +78,16 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
                 bSaveFormulas = rStr.getToken(0, ',', nIdx) == "true";
             if ( nTokenCount >= 11 )
                 bRemoveSpace = rStr.getToken(0, ',', nIdx) == "true";
 +            if ( nTokenCount >= 12 )
 +            {
 +                const OUString aTok(rStr.getToken(0, ',', nIdx));
 +                if (aTok == "-1")
 +                    nSheetToExport = -1;    // all
 +                else if (aTok.isEmpty() || CharClass::isAsciiNumeric(aTok))
 +                    nSheetToExport = aTok.toInt32();
 +                else
 +                    nSheetToExport = -23;   // invalid, force error
 +            }
         }
     }
 }
@@ -99,7 +111,9 @@ OUString ScImportOptions::BuildString() const
             "," +
             OUString::boolean( bSaveFormulas ) +  // "save formulas": not in ScAsciiOptions
             "," +
 -            OUString::boolean( bRemoveSpace );    // same as "Remove space" in ScAsciiOptions
 +            OUString::boolean( bRemoveSpace ) +  // same as "Remove space" in ScAsciiOptions
 +            "," +
 +            OUString::number(nSheetToExport) ;  // Only available for command line --convert-to
     return aResult;
 }
 diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
 index bd7402231333..1c544fb6fa1a 100644
 --- a/sc/source/ui/docshell/docsh.cxx
 +++ b/sc/source/ui/docshell/docsh.cxx
@@ -45,6 +45,7 @@
 #include <sfx2/objface.hxx>
 #include <sfx2/viewfrm.hxx>
 #include <svl/documentlockfile.hxx>
 +#include <svl/fstathelper.hxx>
 #include <svl/sharecontrolfile.hxx>
 #include <svl/urihelper.hxx>
 #include <osl/file.hxx>
@@ -120,6 +121,7 @@
 #include <comphelper/processfactory.hxx>
 #include <comphelper/string.hxx>
 #include <unotools/configmgr.hxx>
 +#include <unotools/ucbstreamhelper.hxx>
 #include <uiitems.hxx>
 #include <dpobject.hxx>
 #include <markdata.hxx>
@@ -1920,7 +1922,7 @@ void escapeTextSep(sal_Int32 nPos, const StrT& rStrDelim, StrT& rStr)
 }
 -void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt )
 +void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt, SCTAB nTab )
 {
     sal_Unicode cDelim    = rAsciiOpt.nFieldSepCode;
     sal_Unicode cStrDelim = rAsciiOpt.nTextSepCode;
@@ -1966,7 +1968,6 @@ void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt
     SCCOL nStartCol = 0;
     SCROW nStartRow = 0;
 -    SCTAB nTab = GetSaveTab();
     SCCOL nEndCol;
     SCROW nEndRow;
     m_aDocument.GetCellArea( nTab, nEndCol, nEndRow );
@@ -2384,35 +2385,129 @@ bool ScDocShell::ConvertTo( SfxMedium &rMed )
     }
     else if (aFltName == pFilterAscii)
     {
 -        SvStream* pStream = rMed.GetOutStream();
 -        if (pStream)
 +        OUString sItStr;
 +        SfxItemSet*  pSet = rMed.GetItemSet();
 +        const SfxPoolItem* pItem;
 +        if ( pSet && SfxItemState::SET ==
 +             pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
         {
 -            OUString sItStr;
 -            SfxItemSet*  pSet = rMed.GetItemSet();
 -            const SfxPoolItem* pItem;
 -            if ( pSet && SfxItemState::SET ==
 -                 pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
 +            sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
 +        }
 +
 +        if ( sItStr.isEmpty() )
 +        {
 +            //  default for ascii export (from API without options):
 +            //  ISO8859-1/MS_1252 encoding, comma, double quotes
 +
 +            ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
 +            sItStr = aDefOptions.BuildString();
 +        }
 +
 +        weld::WaitObject aWait( GetActiveDialogParent() );
 +        ScImportOptions aOptions( sItStr );
 +
 +        if (aOptions.nSheetToExport)
 +        {
 +            // Only from command line --convert-to
 +            bRet = true;
 +
 +            // Verbose only from command line, not UI (in case we actually
 +            // implement that) nor macro filter options.
 +            bool bVerbose = false;
 +            const css::uno::Sequence<css::beans::PropertyValue> & rArgs = rMed.GetArgs();
 +            const auto pProp = std::find_if( rArgs.begin(), rArgs.end(),
 +                    [](const css::beans::PropertyValue& rProp) { return rProp.Name == "ConversionRequestOrigin"; });
 +            if (pProp != rArgs.end())
             {
 -                sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
 +                OUString aOrigin;
 +                pProp->Value >>= aOrigin;
 +                bVerbose = (aOrigin == "CommandLine");
             }
 -            if ( sItStr.isEmpty() )
 +            SCTAB nStartTab;
 +            SCTAB nCount = m_aDocument.GetTableCount();
 +            if (aOptions.nSheetToExport == -1)
             {
 -                //  default for ascii export (from API without options):
 -                //  ISO8859-1/MS_1252 encoding, comma, double quotes
 -
 -                ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
 -                sItStr = aDefOptions.BuildString();
 +                // All sheets.
 +                nStartTab = 0;
 +            }
 +            else if (0 < aOptions.nSheetToExport && aOptions.nSheetToExport <= nCount)
 +            {
 +                // One sheet, 1-based.
 +                nCount = aOptions.nSheetToExport;
 +                nStartTab = nCount - 1;
 +            }
 +            else
 +            {
 +                // Usage error, no export but log.
 +                if (bVerbose)
 +                {
 +                    if (aOptions.nSheetToExport < 0)
 +                        std::cout << "Bad sheet number string given." << std::endl;
 +                    else
 +                        std::cout << "No sheet number " << aOptions.nSheetToExport
 +                            << ", number of sheets is " << nCount << std::endl;
 +                }
 +                nStartTab = 0;
 +                nCount = 0;
 +                SetError(SCERR_EXPORT_DATA);
 +                bRet = false;
             }
 -            weld::WaitObject aWait( GetActiveDialogParent() );
 -            ScImportOptions aOptions( sItStr );
 -            AsciiSave( *pStream, aOptions );
 -            bRet = true;
 +            INetURLObject aURLObject(rMed.GetURLObject());
 +            OUString sExt = aURLObject.CutExtension();
 +            OUString sBaseName = aURLObject.GetLastName();
 +            aURLObject.CutLastName();
 -            if (m_aDocument.GetTableCount() > 1)
 -                if (!rMed.GetError())
 -                    rMed.SetError(SCWARN_EXPORT_ASCII);
 +            for (SCTAB i = nStartTab; i < nCount; ++i)
 +            {
 +                OUString sTabName;
 +                if (!m_aDocument.GetName(i, sTabName))
 +                    sTabName = OUString::number(i);
 +                INetURLObject aSheetURLObject(aURLObject);
 +                OUString sFileName = sBaseName + "-" + sTabName;
 +                if (!sExt.isEmpty())
 +                    sFileName = sFileName + "." + sExt;
 +                aSheetURLObject.Append(sFileName);
 +
 +                // log similar to DispatchWatcher::executeDispatchRequests
 +                OUString aOutFile = aSheetURLObject.GetMainURL(INetURLObject::DecodeMechanism::NONE);
 +                if (bVerbose)
 +                {
 +                    OUString aDisplayedName;
 +                    if (osl::FileBase::E_None != osl::FileBase::getSystemPathFromFileURL(aOutFile, aDisplayedName))
 +                        aDisplayedName = aOutFile;
 +                    std::cout << "Writing sheet " << OUStringToOString(sTabName, osl_getThreadTextEncoding()) << " -> "
 +                                                  << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
 +                                                  << std::endl;
 +
 +                    if (FStatHelper::IsDocument(aOutFile))
 +                        std::cout << "Overwriting: " << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
 +                                                     << std::endl ;
 +                }
 +
 +                std::unique_ptr<SvStream> xStm = ::utl::UcbStreamHelper::CreateStream(aOutFile, StreamMode::TRUNC | StreamMode::WRITE);
 +                if (!xStm)
 +                {
 +                    SetError(ERRCODE_IO_CANTCREATE);
 +                    bRet = false;
 +                    break;
 +                }
 +                AsciiSave(*xStm, aOptions, i);
 +            }
 +        }
 +        else
 +        {
 +            SvStream* pStream = rMed.GetOutStream();
 +            if (pStream)
 +            {
 +                AsciiSave(*pStream, aOptions, GetSaveTab());
 +                bRet = true;
 +
 +                if (m_aDocument.GetTableCount() > 1)
 +                    if (!rMed.GetError())
 +                        rMed.SetError(SCWARN_EXPORT_ASCII);
 +            }
         }
     }
     else if (aFltName == pFilterDBase)
 diff --git a/sc/source/ui/inc/docsh.hxx b/sc/source/ui/inc/docsh.hxx
 index a519f4c87d04..6a075ff6dade 100644
 --- a/sc/source/ui/inc/docsh.hxx
 +++ b/sc/source/ui/inc/docsh.hxx
@@ -230,7 +230,7 @@ public:
     ScDrawLayer*    MakeDrawLayer();
 -    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt );
 +    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt, SCTAB nTab );
     void            Execute( SfxRequest& rReq );
     void            GetState( SfxItemSet &rSet );
 diff --git a/sc/source/ui/inc/imoptdlg.hxx b/sc/source/ui/inc/imoptdlg.hxx
 index bac941c2a377..382067d67813 100644
 --- a/sc/source/ui/inc/imoptdlg.hxx
 +++ b/sc/source/ui/inc/imoptdlg.hxx
@@ -32,7 +32,8 @@ public:
         ScImportOptions( sal_Unicode nFieldSep, sal_Unicode nTextSep, rtl_TextEncoding nEnc )
             : nFieldSepCode(nFieldSep), nTextSepCode(nTextSep),
             bFixedWidth(false), bSaveAsShown(false), bQuoteAllText(false),
 -            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false)
 +            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false),
 +            nSheetToExport(0)
         { SetTextEncoding( nEnc ); }
     ScImportOptions& operator=( const ScImportOptions& rCpy ) = default;
@@ -51,6 +52,9 @@ public:
     bool        bSaveNumberAsSuch;
     bool        bSaveFormulas;
     bool        bRemoveSpace;
 +    // "0" for 'current sheet', "-1" for all sheets (each to a separate file),
 +    // or 1-based specific sheet number (to a separate file).
 +    sal_Int32   nSheetToExport;
 };
 #endif // INCLUDED_SC_SOURCE_UI_INC_IMOPTDLG_HXX
 diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx
 index 5d00d39bd837..4e4e74a 100644
 --- a/sfx2/source/doc/docfile.cxx
 +++ b/sfx2/source/doc/docfile.cxx
@@ -328,6 +328,8 @@ public:
     util::DateTime m_aDateTime;
 +    uno::Sequence<beans::PropertyValue> m_aArgs;
 +
     explicit SfxMedium_Impl();
     ~SfxMedium_Impl();
     SfxMedium_Impl(const SfxMedium_Impl&) = delete;
@@ -3240,6 +3242,7 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
     SfxAllItemSet *pParams = new SfxAllItemSet( SfxGetpApp()->GetPool() );
     pImpl->m_pSet.reset( pParams );
     TransformParameters( SID_OPENDOC, aArgs, *pParams );
 +    SetArgs(aArgs);
     OUString aFilterProvider, aFilterName;
     {
@@ -3301,6 +3304,16 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
     Init_Impl();
 }
 +void SfxMedium::SetArgs(const uno::Sequence<beans::PropertyValue>& rArgs)
 +{
 +    pImpl->m_aArgs = rArgs;
 +    comphelper::SequenceAsHashMap aArgsMap(rArgs);
 +    aArgsMap.erase("Stream");
 +    aArgsMap.erase("InputStream");
 +    pImpl->m_aArgs = aArgsMap.getAsConstPropertyValueList();
 +}
 +
 +uno::Sequence<beans::PropertyValue> SfxMedium::GetArgs() const { return pImpl->m_aArgs; }
 SfxMedium::SfxMedium( const uno::Reference < embed::XStorage >& rStor, const OUString& rBaseURL, const std::shared_ptr<SfxItemSet>& p ) :
     pImpl(new SfxMedium_Impl)
 -- 
 2.31.1
--- a/SOURCES/0001-set-Referer-on-loading-IFrames.patch
+++ b/SOURCES/0001-set-Referer-on-loading-IFrames.patch
@ -0,0 +1,93 @@
 From a7bc0ab5215734cb2bd4162cb5cdcc69fef23ef4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 11 Apr 2023 10:13:37 +0100
 Subject: [PATCH 1/3] set Referer on loading IFrames
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 so tools, options, security, options,
 "block any links from document not..."
 applies to their contents.
 Change-Id: I04839aea6b07a4a76ac147a85045939ccd9c3c79
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150221
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150751
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit acff9ca0579333b45d10ae5f8cd48172f563dddd)
 (cherry picked from commit 04c8176fb40d2eb983aa0bd0a6ce65804d3f6ecd)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152094
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 789155b523b384df020d86228ac200a63a68b154)
 Conflicts:
 	sfx2/source/doc/iframe.cxx
 ---
 sfx2/source/doc/iframe.cxx | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)
 diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
 index b5291b239164b..5a0ea96a234da 100644
 --- a/sfx2/source/doc/iframe.cxx
 +++ b/sfx2/source/doc/iframe.cxx
@@ -32,12 +32,14 @@
 #include <com/sun/star/ui/dialogs/XExecutableDialog.hpp>
 #include <com/sun/star/embed/XEmbeddedObject.hpp>
 +#include <comphelper/propertyvalue.hxx>
 #include <cppuhelper/implbase.hxx>
 #include <cppuhelper/supportsservice.hxx>
 #include <rtl/ref.hxx>
 #include <svtools/miscopt.hxx>
 #include <svl/ownlist.hxx>
 #include <svl/itemprop.hxx>
 +#include <sfx2/docfile.hxx>
 #include <sfx2/frmdescr.hxx>
 #include <sfx2/objsh.hxx>
 #include <sfx2/sfxdlg.hxx>
@@ -166,14 +168,19 @@ sal_Bool SAL_CALL IFrameObject::load(
         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
         xTrans->parseStrict( aTargetURL );
 +        uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
 +        SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
 +
         if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
         {
 -            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
 -            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
             if (pDoc && !pDoc->AdjustMacroMode())
                 return false;
         }
 +        OUString sReferer;
 +        if (pDoc && pDoc->HasName())
 +            sReferer = pDoc->GetMedium()->GetName();
 +
         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
@@ -196,12 +203,11 @@ sal_Bool SAL_CALL IFrameObject::load(
         if ( xFramesSupplier.is() )
             mxFrame->setCreator( xFramesSupplier );
 -        uno::Sequence < beans::PropertyValue > aProps(2);
 -        aProps[0].Name = "PluginMode";
 -        aProps[0].Value <<= sal_Int16(2);
 -        aProps[1].Name = "ReadOnly";
 -        aProps[1].Value <<= true;
 -
 +        uno::Sequence < beans::PropertyValue > aProps{
 +            comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
 +            comphelper::makePropertyValue("ReadOnly", true),
 +            comphelper::makePropertyValue("Referer", sReferer)
 +        };
         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
         if ( xDisp.is() )
             xDisp->dispatch( aTargetURL, aProps );
 -- 
 2.41.0
--- a/SOURCES/0001-tdf-121203-DOCX-import-fix-loss-of-free-form-text-in.patch
+++ b/SOURCES/0001-tdf-121203-DOCX-import-fix-loss-of-free-form-text-in.patch
@ -1,334 +0,0 @@
 From 920f64d73cbb1b41f5a9eb26f8069aef45f29ff0 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.com>
 Date: Mon, 12 Nov 2018 23:01:12 +0100
 Subject: [PATCH] tdf#121203 DOCX import: fix loss of free-form text in date
 control
 Date SDT from DOCX is imported as date control since commit
 3ec2d26dc2017ac4a27483febfc63328632f352d (bnc#779630 initial DOCX import
 of w:sdt's w:date, 2013-04-30).
 One detail I missed there is our date control is strict: it doesn't
 allow free-form text. However, DOCX date SDT has an optional ISO date,
 but the actual value can be free-form text. This means that importing
 free-form text without an ISO date is lost on import.
 Fix the data loss by restricting the creation of the date control: only
 do this if we recognize the date format or in case we have an ISO date.
 Otherwise just show the free-form text to avoid data loss.
 Change-Id: I8125bdc749954a6a1c496de74b6682744adb7680
 Reviewed-on: https://gerrit.libreoffice.org/63311
 Tested-by: Jenkins
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 ---
 sw/qa/extras/ooxmlimport/data/tdf121203.docx | Bin 0 -> 12702 bytes
 writerfilter/source/dmapper/DomainMapper.cxx |   2 +-
 writerfilter/source/dmapper/SdtHelper.cxx    |  44 ++++++++++++++++---
 writerfilter/source/dmapper/SdtHelper.hxx    |   4 ++
 4 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 sw/qa/extras/ooxmlimport/data/tdf121203.docx
 diff --git a/sw/qa/extras/ooxmlimport/data/tdf121203.docx b/sw/qa/extras/ooxmlimport/data/tdf121203.docx
 new file mode 100644
 index 0000000000000000000000000000000000000000..5aa3b2ed74744972aca0224e6f7c4102aedb7462
 GIT binary patch
 literal 12702
 zcmeHtWmufqvToz<?i$>JdmtgWTX1)GclY4#?lclyf;$9)y9R<2+;3<0%$b?&+4tW6
 zXE#sxS9E{%QdC#1dTXtcmx6%A1V95|0RR9Q0FE*=z#j|%h=BqCFaWUNn(u6FoQ!Rp
 zbd}xhj2*R^+^nrg^C7`$asl9=`~Um+U+jT~L>ak2A=Hpls%MzG4-m^9ECY$xxmTq!
 zmFMkD?-qxAj7%S{PKhL?%JYgeI$}Swo<58rumw&@rc8nJ(^)Fc$$2n<Q&<;|F&Ni;
 z9lT9`j~g^BVvba3g)}7EI~v*TbPS*<=S;05hjbm}83Awj+{eq}6t7wHK3DV2w(Jnf
 zYY3m!!&N(T834wXyg6`l1I*zy^E-B(sqOT>ci{}JHM*7Uid32ONtpiPcRfbyT3c1`
 z-X>+Z0_BlwU<1!pLl1U<-Hj({`R8<jX5?OO=;<uC)Av!PsuLVnv4kn+n+@*Ol<ZeY
 z=@+Wt<i^#bg*;Pl(}-S#kr5Bk&rWGARxys(m1zdtk>dqjT#50w%fA;kE>s-51ftRu
 zDoJ-f2iSkuZ&o=GQR{ga?NT@jcMaHK$5%Sn>46J>VTlrL#UTIE4zaHFVCraP6r(<E
 zB;D>T{?Pl9f4mw{T5gEX10zUdrYf==#u3xtIdOtgew-{kw>8eS>~sqU0KB|F0ObFc
 zxx{h!O&6eWlm#Uw0w{BJ9gM9UnVEjR{x@U)7pLi8{`IK%Wl0EO#E?^{b^Rf4u4Q=g
 z>BTkiJXi8Vh@iA1FjwTU!lllR0@7CbWu0%Ad!ur58G#uyd?ozQHTvqaxeFP3V(XS}
 z)=iNx^6EpH=>eulViQ1f8{0W%{<y?E{;1a#`CIiN!jyvKCTze0t>B?f<<?k22{@&X
 zabpBmQ5CJ7gO?v5($k8U)RD|hPlY}Ws&VShA!~Et`@ox=E{uj_4Z-N!E;1R=SxF2y
 zL|f2aG2mOVOuovBGpK~;+%V6dy%KrRjf@FqfXjmmpS<vL&V<m=L2+8lcOR_bBOy~~
 z!1nfhco$gDY$gb*VgH^ZUVJG$<e*PlAOHYD04$iRt%DKszY@jB*3j7+ROo(IxIdBx
 z3{>VocmMBxR3^yC1+n~VnV)XMRMn1Nti$10tf)R;VN@~;N_HARdG5ffhabs@VUjUP
 z@0|Q9(WcQgt8xiW99<t!WZy#$9N8Vf4iK=im19y5qO@kBHx&kA$5z#E7t9hV$M=vi
 z$OI~g*V3p-%xKxilm}@T9N`1?#rSlk;ER~uC}tBF{Fvj7hP~ee8V8P<B_Mp`x}%M3
 zw8j|nHRY>{4zMiAwgj>VY`}_an&7e)G5bL-yKZd^-!}Jb`MtGHblqp~ADMkjcoy!!
 z)rq3`gtbwS_e0cDerE7xCH;puid$6F9ZA9dP=~P76{Zglb#@PezpclIA2u>2gcEyC
 zUnZtiPs+0gKUhj`S;>ZfSXh1WNb2~e6NDnDb&dSj7z2P9RJoIxOlUECl`m)wPJ;me
 z&_Gf4Ta5iRx>S_m01znrJDNYA&Ta?*FvxvSJVF|Q;;cwz*k+jpwPTMSat%wOx(PNe
 zkW(~(FbZ47gUKu+K1`lcc-m#P<}^&B3euk-r*CnsJ&jDP$<<f#<hYDeIs)?jJlT&@
 zQdVPfxi2*-FuvjZhPC3aQv#^=#gSSywO5I^l;gD}g0BF=skgb}0q~Y8gpeVa4SnBQ
 zjYOm<*gR#7@P-%+gP>u`zUrZi=JC-o!f`-PuNu}4LUY*dYO<G=0t~5~!x_VPQ6wvM
 zT}NP?f*F@tCyvm7z3vDU7!6;^ZAc$u<gw7_gVN;)@+OBhLn||oo1^@T3Ax4f;fwEC
 z1tXyc@}U-emHRq(N(qG7JFK8BqfySjgH7h;%n84$N%M`u4K|f74A>{1$g@kYH&!&D
 zy6?-e7zei88FzTkIFxv>yWlM)xE%w_UGGTL#-l=t(ng2)an!mY=p-H!5z5Y!At?5n
 zKdg#3wEo~<z|l-2t|-7rbPdzrD|~~28FIMm#oHoWWg)}XzTH^IU{b&66m!6WW2U$)
 zS@rnt2EU{?Qy;?2a||QVK+2cELV@K+IpRB&5-&TPib%Pqag%M5k0pSKjQR%Wf*#+;
 z>zK$|#ji-J5yh5P=kpjk%$0?weW+u!3|gzL-_pM+vN4EqKyH)MjhB)+N1hY`ff}Mj
 zUu;>IRT|E^Fb;cTQ*_)gLiK~q2hFcCG7Au+8`HR8%LzL2AaOg{Ub+)io*!}eH;%;;
 zhS@8tMZxwK(I>jY*9SfgOD-r+v1>F-_5J9%-cr?|AJzHBPN0Smp#;z8``TWemG)R@
 z%ylljL_K_G7B{*lXs-Gl{UZ*^r#9S7xcfkL@R_bLKI(b=d59a9fNSGsd(IcX+1WRL
 zXA~@}?`TV*0f0gR000XVoWDh~lbNx#G4pS)uYazUN9uC6%bb{9C=0HnPPT^BF8DCc
 z5eu~$j4}j$Hlf7k;mHf~`9jkY-ULhAeqg<=`k`10)}i{E{@4pe5A2J)RzzQFfMSaA
 z{c1Y#oC^_Ef|TfY+Yc|qBxM!zCxeJY=w!5VOFB;u<L@ZX-Gvf>$E(EG%vJ8<beWK;
 z=Rpk}v~g>nqHosQBIZ>@3<C7L$>;5tBNHX(Q<4i&dewBk(MssqjJ=P-YLBp^MZJaH
 zAFwiSQPtFrcrC-9xPd#ghX1il?u&fFC8xud0CY`wyvJu#gIoy=)8KAs80Y9%rA1?K
 zB7?bWKe^8zLv}iUp!O<ui!4{9<uo<eJHyqOMy6^28yl)^eHL4-gzbP<ZV`6MELArI
 zRrH!r-Vk~g#Pf$&tsNf1lK|jpV6kd4>$s?I)!MLmve31CwoB7oC5M(*`145SSe0za
 zS1aQ>wR~tJ5(3BDPfHetj*Hy{vHe_oXVDWTO>GAoNJCp6_RgN@t7bzYxpKp%cJz>|
 zh?Y)GXAp)`>yIUG@juU7;CY1vn9<}*)#F}>Fh+dBUEj_}0U#NvO+l8KOAaiA(wuC$
 zQPRvIp7C}U;qmQ^wvde@Na%i1{?vh@goyXL;O5}&rY8H%`$3d!qBpnSZ#R3lVcuxG
 zohY}?4BAy;?s__!93&}tlkIcyV+v>1O?}|yzL&b|@zI?Fb=s6_B9b}h@%m^uvPSUf
 zsZ9*)OvYc#_%?PxBtK&Z_V@x9lTFqB6*Yx@Csr@)*B=q%l!@Hk=~7Tn*%5@7<FqDe
 zu7o_ieV;anz;+AZ-Mk$p(cDnO!}GB+UGo>fP8=q9wUjmV#V+X5+_@!sEWQ~i4jdbL
 zsr9!-Vhnb5NWeR@p-73H+lUapzQL8nM3#7qIqmr97Yl!UqIj_2oN^x^C8)a3^qxqX
 zUWT=hf;!zKve6vTCr$M`;<JlYy(f$_cg3_vBw?%g5d0Wj5DEIX)N|f!8p028gj=ae
 zNIno1rIJJ4%D2W^a&%`-;<#cRe&Xt%z9j>^rDWH;<!k9yJ4cIaBQYb0m8aVMd6+4h
 zZiTse>@|XkzEIK`zKMlF&Br~qSAkmJwF%jGJ%f<NZhb(071JhH1Kni4AI6S=D!_(@
 z)!8oFjL{WHOJHaqiG=A~qB_Wa*VZ#mqii#}xdqRaID(`5raJb)nsG4$=&7<hb{+n<
 z1J<>U-?asHe_1!H>5OubA{O;RbEa+Uv6|cS<!-B;CWpC`a<ZHS(`+?zL3Fuc^}MIr
 zQyPz;l$L_4(7gTCk$^A>^cAn;7G*yzL-dA%DJzSeUEXICBy=rr5f%0@J9rt-)vqFN
 z)8dd{Nwx&_=HpctR-J#jrT3h%I(QdWMTlOZO}wy)C6JlJ0naL0{)N!YQItOYvwB*U
 z)^J#WO-*lQbucemQ!Cmy=KE01ygJTWp2WamgjqcxkcyoHR)Y-qgD&%q!;<?*PZZqR
 z^{`-taR345J2~E_pON6S$K*q)O=jZYNG7=k3IXE%hFip}<cdc65rG|FWWvZ1KElH8
 znkNSHE*k#@x;$T63<E7SwbU1dWlN5f4B{X5OV<N-vLS=qP&HDkVg}ef#tAh+NDoR0
 zi$-^28C6=Zx!?}$uJn%uOMpr+ie$6c$#F<XY)QcYDRyf57YB?n4+VH-<$`*N+B)d&
 zvl<C77bk700mH3|x_T*!C6{Xs`XaCVFkF#tH2m7|g~1IUqVilhp;ub2sS&xl8#c0<
 z%hE0VJW{PcqEovU?Z>8JO?OpG%(92EZQvEj0^RAuVOmv2Y!dmp=%{v?#giOxUnZ5O
 z9^h64D<PL41htS5qMV8w1elcj^5Bcmt{%YgVU+ktH8y;3ipfeh0+t?ecI020cudVx
 z8$#X{E|rj>V_s8W!M(lCWk}oS3sw_YZex&0Mq@=&LH|&!dW6P9X;o^uQNFe;fGJ#>
 zVG*AM7RZO^d*YcaTp-WIv+LzZr(S!rM0i`mN0Kp?o2VHo^Dbez3$@k^#iXrV+ctU6
 z(^ef#;I(BvzPl=*ep>a*$n-PEd+t3|OZvIYfzfd-?z64-0TwlO5!w|pvL~49H*{Vm
 zT`v1b&O<kOjpVm(dEvqfLdv>z(J<3c)5tNo_H}`rsqD0tOO?*ks-s+o2q#VmozziP
 zulORnCe4rXc^nscTHN9WCK!$umSPy$Ioz&|B6_}XzZt?EOr12^WmflcLLuycT1TXk
 zmcWoc%aYXF&x4^tA-!W1t9ROF1{JP<Zv^<~ow1!kq$>}!>xK45X>&Aoax%9ub^KY@
 z8dR5Umbp>AnSn2)`|d;%F<FprGxIZMI!M=;RKLT>lUrkKBE1`lc(~%D>@Qs`6t3+T
 zOiLe4!^=*~V_p{&k0ZiWtDdE+ksaYTEdQEVu}b&i(Uh&dljba<K;B?b@i=7le0|Ww
 zmGaIy&C$$+El9pGd6jOR&-5T4xSB0tAlIM|pQMQt&;1yrO$N7eV=`xM9=6ShvqBW<
 zuAaS15v8*$Q0ftsDzWC@=yBLCRn?@qR(nqE{&})5I-9HY@Rbsi2!kKom@s|Y-T)Q*
 zo$eH{&l{YlUA0d*!iY<G*D~3#B@p_4|D5f+I}Ajt;T*ZJVxPmS%>%Sz4SooZ_5+Oe
 z1M&eTe$3Vn#@sS#n&)FLP>mFkP3=(NaVA!PoZzDaIldzQ2Jj4vQtUe{ml>`qW6qfn
 z;ZRC_KAlAOO{_#~3FZ|dbAl42bVAsHH#r{<Y~=i$VuTIFL$P!%cZDL2#IACdv<(Nr
 zbi^T}p7!##%fdUNh$F<uXe0-pSIkBnl&?PLU_JFpT_BT5RWi<;Igm!z!(_5D$N&e3
 zpfnACAiWH%(cZT-#TX8TGCc(&>PY#~lH4K49;{9QIVh?JE$?#zps3~oGLT@toJlC`
 z+<ged3Kx;1W@5GYx@lXbou9`rnKHV&#jqC4mBD_Iad+4MT`HaAA+xJy0^9O5@O-ee
 z?pkVtxw$opTF#itkU$G#5uAE)pa$+T-WlP>*DmRjv6o}GbDrHhBe7mxSxq8H&9H|0
 zJuX09$z~jB8CtED447djhTx_U;dph2HabZdh?47xQGg^QT}TsLfgOqVk=}LGIDWa)
 zIzFXG;YD_q{(cug3{0&yEhXwi&6~9iUwTEAn(l4wb@<v~m2Y&I&Nr3T%eB377jw||
 zQIy+ATWDJszmaTUW5KgP`_l;2`my$|H=&P$mwk^|TgJy$_b;0%^T8<7cL!4*{BD76
 zA{FN>!?FoSPVt+9(Jqk^jnZ|ylzdXGUgsemAK736Dm=9qzVGj9G6oUjKBWd#Jf;n;
 z({}cF8sIvd-cWFM#st{wFCEF(!>klWIfSCLY%0gYXjSg=Blegv4k_H6gjb3E82A>>
 zUeHHItCD*W?uZ-cySsJcGFWSzQD9Z#{OBpIWp{{gV&}+*q~@TOEF21v^sK4%1j@vJ
 z&rzIQY*}zn`&|ioV*Zh%uEqvRe@WA*FWr(5uTh~l+BWzYTACJ<$m^V%NEOe?1MUIl
 zE-nOPMm^FNm2$RA<)k_uqm*eM(|lX*g>*Y0A`8Bhndnr&2NZP&mnqdSA1+3hQ>L-t
 z%7O8If>Ee={$Y@|jF@36UiO$+P9v<*khN5dsae%;0~S3-`<CV-#p`rs$!vCfpXL6v
 zS5Z_g(HBg|S1Q`N6}BOh3TA{^!F+XmL9sDU>D@SS0an_HB#b!)##>~p>Zr62xo_Of
 zv~G>l``^H38KdKWZD%Nu!}t!NvXpV}_O^zu;kXwwY<wUE(y?CNJN%=8!@i)tjMr!)
 zlp0BO^i5(8@u^hai_wZN$SeQuGho&NO&h53)DZvx@c;0cqm#RpvEv7GC$sk^CdP(N
 z|61TOtd&3u+~E59m^aMF^>^aAJ0tAJ^7{~M)*m@pZZvAK^1B<od`Rtbo>k+kaQPZt
 z4R2J!4UcU<wB6U_PPd^<>TmF$Q)01dG=JU3nBR<}_C^z6Sb1oh6!UG7O|Km?^^dyk
 z@!l+Z*nG<IZC}<YT$K8(1cNB@y`S?M`-EzAD{`3fij&{yyFE?2NU=i}ktb{B(3OUp
 zS6x#0o3t!xxl1{Fa)In(p*Djl45`%~t%U|ELt-#X#)Meo@3qpzRAf@b7q_sLgA5q-
 zXkkZCRymm|CObXj3H$kW`$N2iAzHYh5xyg65)=^vT5LZwJluy0q%o-BP(H)p6%nAF
 z_HfVO2Q|}bdmO-T(ISrAG@f5pcGr^`I@o0a84C?ef%-O+Mz<#NxT)^)cdN#qZ0tRz
 zv83bBjC=0=>^C{;FDZ@4>r9X{(hqieJa84)b<xuX=d#og>s>GeG&C*L(fRp!=ILwj
 zH6&TTsI`tFMYbFUt@VT27>q{v&jrVqV+vT`J7LPsid@I%8Bpq!y`^muwhYfDUM|!{
 z)eo$g)ehk7VbH-<--1DR>4=uuZ4yjOAF*Otou&|6&8^wCvsb7+(0FaiV!nPtu@bD+
 z+ng}jO`zZHt}q3QBpxy4=WW$h6;N-!o`OGO(n=;|WKOCLN3MTtLbrLObGt3n4o`!j
 zN8z^0vPUJ8f87rkG;(5v9AP5(I5N9a$DaTtLI6;kW$>yT=QhKjnVqKL^ctOCFT5Fg
 zGKSV=&>9a2z2RyKkA)lB@9}<6eZ9FEAG%d>=3R|1a(*PZ1e^0xzd7YS^0a!9lk<rm
 z2U{Rb46oT&a9#zq@VUhF<Deu}w^N^Th;J!au6}F`ycl0%WER&q;plRbXHD`Fs!&f_
 zf(d0Q$A*_IQX*$TTy`Zi6^Jh`5}nz|T=twReHoinPUpxOk#}~?dK7Hz6vdo$D&cY#
 zR02v~v+ms9%L;WCA_Wm1V(byct|A4ZAVD%8B!Ghi^fkWxxb-!(XeXDLvsCPA53H<%
 zMIpu`zBs5a)Sihpyz&PTs@p4dK?0NvYux3vbE_xlqsE;hcGVU<0$L0y>g2O7^`@e^
 zd=*8WKq_DOZ6qnEqmc(8h>~YnYwt|vaKB?ql!Iv6PElzO!@8#6Rp_y80=!#(`;*)H
 zVH*8Ml<y4VOa=2T{^n0q#GGjmZEt5CJoWb&6V?PV2A;X%4tVyDzU?vQUE+!Dp0yV-
 zEl2zAbq@79SfIAWITq{%vCpF}^`Fr4D$!b0SFh11gR_vOx(K5PFN@vUrX#F&j=Uc5
 z{ThMX@bPS&y&B^9@P2=SS>3#PbCM3(!hL+$@<tMxReevm1=?d*Usk6Z+aJNdJ*>(*
 zQG9He{x->rHzgaUt404HF*7nN2AyWd2{%H=>Q-$?qHK6A5fzO`m}4&LGk)<WNK|zv
 z-*f7`XIN=#XpN#{oqAWEoW?Og1L+L$y(v@uv%qEL`wL)V2JEv|yaS9FpS8NXnuda0
 z@j99Vf8{xvP%kej7<(lax)9^lROeo;02&J38X+7*9m6tH@hEcDm}4EQCTbN_)C?Ee
 zLrwDRvJS#{XLxQb#>`O$EIbe2CmoXqssIj+brGOOtEgv8dAcNA#0pmhX&Z)+2z!hh
 zh0t~w7x-^NZ+{yJYqlGOnvpdyT?5M&QoQT!oyvMZ`BpR_?o)TE_BmHU-KjbKYS&5(
 z=^6-JSms<*erVAg!xmDi>up&O{-`8T0LR}j|1)?P0}8hCzy8QnNXJ&yhbLPcTgc$d
 z++sHhnw_H=$XOdjGzNzN3kLc%*kqqzMMNkm9IjWT_I(6sQ`{hvqAAv3zx))Ca87-O
 z+_s|iKt@_vsI;Sz*72*!|90g(!m{na^=<nJ3CYn<AWUXjLRG4|hx$Lj)hXQ|i0>be
 zp%lpR#oE!({=Z>GeSU>)|J`0^*twr}eeWS;Sc8rA*#*Svyia5Y0f&VRpxHv2HM`xs
 z8vr>ivJy#EsRDFo+-~>pUKY-(55CCX-!A)_O#V5WjYf_m*S|iQQs4i*U)OCqwOvK*
 zO%5_1ECU54s^$m;!Il^;3DHXT$=76X;etLoR7H~SK2s%5bU0|TdqiAtC(oS@o#_ZH
 z(e|x{IyvqB%kO3n-`;z~w{k=Jm@vQAS_~ge*d4*wLRGwJji490m)%Fwf~BjzD(ybV
 zMrki)R>Ass^|Fkue2W+6p@*?+?YG+<U5c!1zp<JvJUzI2xRI=Mz7)5b6g54*<@9KS
 zV!Y<*EL#8dR5}at^h`Ym^E8t}tjnNo$qALo)I8;$KPa&Z+_4|gr#aj!%uaJ<f_3;Z
 zC+#)Vy6!pY?ZjnpgY>|04YXHQnr#VnE5w|1l~M9A(Az5?CCpOp8qd$6l-E$OoOJ1s
 za-<haE@Jyz)vGez(9ZDdR?2bp`DDe<6PFWBKT0m2UjDI_F(@<haRQNnUC^F08t6;|
 zwAC!{U~A{dY-sCX{QG(Re-AQ1u8UHXk?Una?4UR&DPLJ;uMkq2bwSU~N)75m4bv2F
 zXRN%FkFQ$pqPA|b!6Iz#_nDl$c8pjQo|_`B#L!3zqoj=xdOaSjk+N^i^Ra}+A)8Lt
 zvMN_Z%+5@8bq#ZDM_SXZcFFGwTnjTXaWsu~YQQtW@Mr;=(pf^U6j0reG!y!zx;D>B
 zYTl39+~eabw~?}vW~`|3+%VbrOr&@d(?eN5Hbf3_`8EA`RIg1B;PjLF7qSo1w2xCk
 zS+d(YmX33Q5Dy!DLRRTi=5;nvEN{9=BKPKPX4OjP=%GvLxJNtAIFz9}`Flr?J3IaF
 z1O*_$^sr0k8<(VNt3Dl$Otj1$GZGS5w;&`H&?Gw8jlpmCB6+SVkOM6b9?1!vU-`Wu
 zWM=evXHAXZIrSVG;ZzmEax|m9@DZLLzIdl2*mOt0(@SGQfkR@Lor+SnL@IuFQ9HXh
 z=UBAhey&iEOs@V(_uQw_4SRna&v)zq#6ka^oyt-~2lIhGvE~H;Q2x$Nf9tt3)*Ul`
 zQc~M*&oCi3GqqU*^U|xb>5cPa4IK@#-?EKk4Q0UWNx39m?lr4e$n^BMzLcbrEPYgM
 zyRSYHuUTIkjJr`XX_+3L&gta77D$8SRUST`?rM2<yG%LV6{XAzb0SZ94jg-GvVDHs
 zzFJkcAtq1r)FU09+|v7Q8!a(OmB7C+qPD~AM2F$lJf+TnsAbZWpl0;O<-0=ewleM~
 z)i_p^gvImoGTqc+8r4ga0`NN>m^L*k=w&%pJpcDuJDN$~JS|-@EnRsLzDmQePIiCi
 zcDOdki=Q65EYzn_6)tw{c+LDdE&On*FFoMfSHnk4u}&Nq)0C$0i9X(d?zW8VTU))I
 zw?yqJ1htXUHq7-EmCX#*XOm)CsVi-K81A_<9Eh~IVOR_IPT4ynq11{y-}palZS+=o
 zA8sU&a$#AXDwjTnzxvko`I{UX<I|#*?_SUK#&Cx?Wz&NvD^IJsif7&BsHP>b?ee`#
 z18>s+)&93<+y2$d@C&<OZHf1QZa~ZeE}R4yj{#3y9S^srP-k=GDIZ_8fvFRiFa)3?
 zJ$Q5}>|M3cw@NMWUZs}1%0LoUEj%~iWgHZjEmI9^5u5mQ(aS-SanE>C)GRet$n-?Y
 z)|yP6O5UR@eL{v-$j6&5@4g*o2565I-2Lb8;Ps><y(l;S($-4>-$fQ+eLo?Q+LIDu
 zA-kBB5PNRh%#^xabO|^d7`VmOCG||$p**a^y{&N#6lObAm<4MXJvj7g4o}#m(n03(
 zALg@S!0z<~YZYWCXX2t$mq00>@|Ws7;2zU;F08bk8p>b8jxPKT65>EY;yy_50||aN
 zjb?pKP46i(vlzksdsHU#d19c=4Rq--B$hjs{E8ups%bdZl7{-Msivz;5iC2FwGCR9
 zs*tKGXi6q=Mw5n}9G3aW<+F}wyc?-}!@gDxVO7R^g!pjU?bjTa4?gfI=`$Y`Np*(E
 zHM8)j^;DCi4OPXwO>>|BvGzW3>bc@t)h20bxy4`qsnVutK-0Q*=ekE$6S~8jGV^JY
 zZt(SfrgRBo^(7v4|5?K;W)L5Y%UkMy$Rn#1mCed#>(P3rhtn3i-xpHK)8^3u1j}vS
 z0Br<7HOTFE(KC5Ha1JCsw<%sqKLkCu^;}6mq>`+j8`F<_-cBFH70(9<xH3Bx){iqS
 zP5SG&s{u{z!gE_bXZIC($BQ#8u-%4xdF%-T)>mlUM`HR5VpwU8?6~1&Ia`^Ja%YTe
 zN6x~Ca`7z(^pL)4K!-85uJ6hj`(kWkLnwcDs9NO9+GC^uyb5awd2ak#?29B|ImJ)6
 z%j%ya<?wyV>>@c$tO)CF=YWV}pckG5g1r))Rj5~z3}Pmp<k&L1j%u2$H<BW-KY6z<
 zLVqbP$-P_k8+so-7{#ni&wYjQb>rUKdK+|_BLK%Cm48o+Y*liSbHZo*DjRe)MwJ2q
 zQ5Bh8?*8fw75Nr)Qa2C}#P~@F!G05dCxjSkR@O8epXk;gQ9FC?%5_0hMFvp&sk==3
 zJY%Z!BroZNxrri-%fAO%Ua1`p)5U42FXMC12kta^!z4v9JrM7K1o1SPpM>o%g5CK^
 zXcYAtB(^4jq)b%=7g%3%C_0D`g2U==n)M2w52(K^_h$&{!<5plLBjL#atJfxltE(i
 z32~@`-oWnckq8M09v-*1AUvn~f7-1{ED0inaHNf#gqXIOQC-?U?et6ElF0=YC}GSf
 z?!hv+_*qmcw!<-ufe4`tV3U3l%AOxY2;qqT$L!yEri@<gr@Wb&a*(I2+-ZbW&Z+zs
 zmh9x)?PDHY&Z*=Vz$_v_zKD^Pk(WBB0xp1+*GiUA071kL92Ub72-3P8VH4tx<ktTa
 z{XhC5tP05`hw%vKm91P>BPEz~PPfko2s~~}ICLyE?ptjeBk0gdqnDFd|IZzvhz3#~
 z^4eY{S12DFYdzQENsSUU#3Z+qPheJxlz75ebe%FOo1gc39(IsFvoGmO3aq+Al!TTK
 z2A{db3vfd|v7^uuE=t_+jaG4RlNwDrV~P2lg{{0Igr$qQS{S&_L}?ETEst2f^<55t
 z&+!jK$|%)Cs07H0IOj$no$eA-uAJz=G#y0@#_$slFSyn(5WO^qIGhSB7A!8>8oCC!
 zUgEh%xW>eV)-;!L^1+7I1EstLf?}&ET>B6OwW!G4U_&9#yG)o;H#_W#H|~O?@|nR=
 z3h}ZUyYPpj?d3`a)xa!^=az7Znwlo<0=chuV!^~iElgL6obv_b;<ek8@iNa2a4%|>
 zRFV0^ui0O%>dYrA=f+$bu3zW;-~vs7{X?A%*~8cx15v_!NB{u+k2-4t8st>gH?aDR
 z6DB6C+HA3)2A_Udat-s+-3n@uDhMez5Iz{!sa%3#86caxr~ZLk*X}*&l8bW*gFY-d
 z;U+tfBTG#DVwrRt3}G(wE&}dV8q11J;UeeGm9aA$1)iG;r?ff+z5}Wd@!lI>ene->
 z=upH5q?vTC!i&zD3qm()_Q3Gt;BEuUEE8hgRnGabr{ycIm4j^emSoBMcRGq5Vxk1D
 z;gQyw!~M3St{S)`502EByc!T$N1OYcT3eiIP2aOXEO)X}<;Pd)^aL4&EIjk!EU4vs
 zIASU}jNNYdWd!`32J*CTR~K_?gLCkUNblc&qiD7&Mfys^lp1eIZJ1{|5I_TLG%Y7<
 zD5Up@v}~s5MWP=Lgg8xw*!)P4GD_JbE#=Hz&LZxoykE4ps<6&R-78cE=@1!ARB8S$
 z8LFs3t4drkB1D;npHWsa{9VzZ&kCCWZ7Lxl!+jrPzxSmul=lD=erH<AerB9ooQBY~
 z7~-OCMcQ4ExWs8}AL9>Lqv8)}_ETKw?Xj>S3CVKxx~C#0+X|w)S+LJEaoac|=!2u-
 z45<TVKsj+p@Nf}Q2W`%3>RQA-!BOZc!68v;aH<0Y^mP+MM7Xi_e{2U@aSvbHfxi2G
 zP&<J7*LFbP&hEe60LW#(KQa|ZWqVmr+bPab6i%v?f&h8ZXmoE0-IOi->WyvD5e6Hr
 znk-(jWxj@x+T1p<S$;Gf3~AFgtz!%+&0@UhZy#c7n5MPPVD+sbHsx~1P5?^cn%0ip
 z;9l_g_&`@|@P`z>HlfrvOlzXO(;UdRs>QIEwU)|S3YMh|$kVT`{?rFU%|*1-#}u&@
 zvB{LDQflIZIR?|eY<*u->QHxs^QOFmx|fjds2vUN&eC>pEJ=z87#BS9N}q0(OczxE
 zTrC{ha1sg1t2GzdjYe-Vg48Jg@s<M!7vOmsolLG!{rG-#BfmoF+C`l7P!1x)229d8
 z+5y99=>mKKv!}i>FfxzygD|`B?X{V;2r#*4BVKgx6APOE6DrUt3&&-0c(07SqvrO6
 z{^pCRBma+#%&6NkrMBz0@hQ5!vTkZhq@_bo633x_)E-fK_w=+h%elPAcgy?R54b+B
 zbhRcBG(y{D2?d63wQspV{{B}d00zzo+Q<LrLGwSpl|QckFm^64^>={3&%6Gi`19Hd
 zS`_~>{raoo--iJIs<;LkcKN@J1pY)KhWL3F@lT^(xW7SxQV&q*{}wc&`wxR(Q2!eI
 z`eo?rR|9{YyZO^ZM8y9vh4U-KujiY8LhOMG!f%%S^|bR>^<R%({#1{|{$2f-gP30t
 zem#iz6QK*|4+H+`SmIZlzwd7Ri2?xBkpKYyw%75i`mY`5p8(qAe>3Cf()g?LuVwU4
 w<$l`VmH$>$f7So{Qv9bj0MJeU7u$bdnB}FQK;Z`fAcB6#KoM-p^z*m>14q_gcK`qY
 literal 0
 HcmV?d00001
 diff --git a/writerfilter/source/dmapper/DomainMapper.cxx b/writerfilter/source/dmapper/DomainMapper.cxx
 index abfc8694535c..52c36c55d03d 100644
 --- a/writerfilter/source/dmapper/DomainMapper.cxx
 +++ b/writerfilter/source/dmapper/DomainMapper.cxx
@@ -3339,7 +3339,7 @@ void DomainMapper::lcl_utext(const sal_uInt8 * data_, size_t len)
         }
     }
     // Form controls are not allowed in headers / footers; see sw::DocumentContentOperationsManager::InsertDrawObj()
 -    else if (!m_pImpl->m_pSdtHelper->getDateFormat().isEmpty() && !IsInHeaderFooter())
 +    else if (m_pImpl->m_pSdtHelper->validateDateFormat() && !IsInHeaderFooter())
     {
         /*
          * Here we assume w:sdt only contains a single text token. We need to
 diff --git a/writerfilter/source/dmapper/SdtHelper.cxx b/writerfilter/source/dmapper/SdtHelper.cxx
 index 2e93f1b98c83..86d153092ddb 100644
 --- a/writerfilter/source/dmapper/SdtHelper.cxx
 +++ b/writerfilter/source/dmapper/SdtHelper.cxx
@@ -17,6 +17,29 @@
 #include <unotools/datetime.hxx>
 #include <comphelper/sequence.hxx>
 +#include "DomainMapper_Impl.hxx"
 +#include "StyleSheetTable.hxx"
 +
 +namespace
 +{
 +/// Maps OOXML <w:dateFormat> values to UNO date format values.
 +sal_Int16 getUNODateFormat(const OUString& rDateFormat)
 +{
 +    // See com/sun/star/awt/UnoControlDateFieldModel.idl, DateFormat; sadly
 +    // there are no constants.
 +    sal_Int16 nDateFormat = -1;
 +
 +    if (rDateFormat == "M/d/yyyy" || rDateFormat == "M.d.yyyy")
 +        // MMDDYYYY
 +        nDateFormat = 8;
 +    else if (rDateFormat == "dd/MM/yyyy")
 +        // DDMMYYYY
 +        nDateFormat = 7;
 +
 +    return nDateFormat;
 +}
 +}
 +
 namespace writerfilter
 {
 namespace dmapper
@@ -85,6 +108,14 @@ void SdtHelper::createDropDownControl()
     m_aDropDownItems.clear();
 }
 +bool SdtHelper::validateDateFormat()
 +{
 +    bool bRet = !m_sDate.isEmpty() || getUNODateFormat(m_sDateFormat.toString()) != -1;
 +    if (!bRet)
 +        m_sDateFormat.setLength(0);
 +    return bRet;
 +}
 +
 void SdtHelper::createDateControl(OUString const& rContentText, const beans::PropertyValue& rCharFormat)
 {
     uno::Reference<awt::XControlModel> xControlModel;
@@ -107,14 +138,17 @@ void SdtHelper::createDateControl(OUString const& rContentText, const beans::Pro
     xPropertySet->setPropertyValue("Dropdown", uno::makeAny(true));
     // See com/sun/star/awt/UnoControlDateFieldModel.idl, DateFormat; sadly there are no constants
 -    sal_Int16 nDateFormat = 0;
     OUString sDateFormat = m_sDateFormat.makeStringAndClear();
 -    if (sDateFormat == "M/d/yyyy" || sDateFormat == "M.d.yyyy")
 -        // Approximate with MM.dd.yyy
 -        nDateFormat = 8;
 -    else
 +    sal_Int16 nDateFormat = getUNODateFormat(sDateFormat);
 +    if (nDateFormat == -1)
 +    {
         // Set default format, so at least the date picker is created.
         SAL_WARN("writerfilter", "unhandled w:dateFormat value");
 +        if (m_sDate.isEmpty())
 +            return;
 +        else
 +            nDateFormat = 0;
 +    }
     xPropertySet->setPropertyValue("DateFormat", uno::makeAny(nDateFormat));
     util::Date aDate;
 diff --git a/writerfilter/source/dmapper/SdtHelper.hxx b/writerfilter/source/dmapper/SdtHelper.hxx
 index b6691b55770b..8942c059e510 100644
 --- a/writerfilter/source/dmapper/SdtHelper.hxx
 +++ b/writerfilter/source/dmapper/SdtHelper.hxx
@@ -88,6 +88,10 @@ public:
     {
         return m_sDateFormat;
     }
 +
 +    /// Decides if we have enough information to create a date control.
 +    bool validateDateFormat();
 +
     OUStringBuffer& getLocale()
     {
         return m_sLocale;
 -- 
 2.17.1
--- a/SOURCES/0001-tdf-137209-unparent-widgets-in-fragment-dtor.patch
+++ b/SOURCES/0001-tdf-137209-unparent-widgets-in-fragment-dtor.patch
@ -0,0 +1,44 @@
 From 96fc7531331f45a314416000150b1141e5686f38 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 2 Oct 2020 16:21:02 +0100
 Subject: [PATCH] tdf#137209 unparent widgets in fragment dtor
 Change-Id: I819514fd2b97e2cc8daad71a7f3b0b27afe6136d
 ---
 sw/source/ui/dbui/createaddresslistdialog.cxx | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/sw/source/ui/dbui/createaddresslistdialog.cxx b/sw/source/ui/dbui/createaddresslistdialog.cxx
 index ae4d354ea29d..994a6045cea5 100644
 --- a/sw/source/ui/dbui/createaddresslistdialog.cxx
 +++ b/sw/source/ui/dbui/createaddresslistdialog.cxx
@@ -53,11 +53,13 @@ struct SwAddressFragment
     std::unique_ptr<weld::Builder> m_xBuilder;
     std::unique_ptr<weld::Label> m_xLabel;
     std::unique_ptr<weld::Entry> m_xEntry;
 +    weld::Container* m_pGrid;
     SwAddressFragment(weld::Container* pGrid, int nLine)
         : m_xBuilder(Application::CreateBuilder(pGrid, "modules/swriter/ui/addressfragment.ui"))
         , m_xLabel(m_xBuilder->weld_label("label"))
         , m_xEntry(m_xBuilder->weld_entry("entry"))
 +        , m_pGrid(pGrid)
     {
         m_xLabel->set_grid_left_attach(0);
         m_xLabel->set_grid_top_attach(nLine);
@@ -65,6 +67,12 @@ struct SwAddressFragment
         m_xEntry->set_grid_left_attach(1);
         m_xEntry->set_grid_top_attach(nLine);
     }
 +
 +    virtual ~SwAddressFragment()
 +    {
 +        m_pGrid->move(m_xEntry.get(), nullptr);
 +        m_pGrid->move(m_xLabel.get(), nullptr);
 +    }
 };
 class SwAddressControl_Impl
 -- 
 2.26.2
--- a/SOURCES/0001-use-gdk_wayland_window_set_application_id-when-it-be.patch
+++ b/SOURCES/0001-use-gdk_wayland_window_set_application_id-when-it-be.patch
@ -0,0 +1,144 @@
 From f1cace2cd06b20fc1431f15892a4293fa3601b39 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 8 Jul 2020 10:13:26 +0100
 Subject: [PATCH] use gdk_wayland_window_set_application_id when it becomes
 available
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: I60775dcbfbc396f195a71f219668944d0bfecf31
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/98325
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 2d8e2813ddc87f7ce03b97e4d603df11613461f0)
 gdk_wayland_window_set_application_id doesn't work when called early
 after mapped it definitely works
 Change-Id: Ide0fa636ee26acea0d938aef08532b9396fe901a
 ---
 vcl/inc/unx/gtk/gtkframe.hxx  |  3 +++
 vcl/unx/gtk3/gtk3gtkframe.cxx | 49 +++++++++++++++++++++++++++++------
 2 files changed, 44 insertions(+), 8 deletions(-)
 diff --git a/vcl/inc/unx/gtk/gtkframe.hxx b/vcl/inc/unx/gtk/gtkframe.hxx
 index ccf9064..49b6937 100644
 --- a/vcl/inc/unx/gtk/gtkframe.hxx
 +++ b/vcl/inc/unx/gtk/gtkframe.hxx
@@ -206,6 +206,7 @@ class GtkSalFrame : public SalFrame
     GtkDropTarget*                  m_pDropTarget;
     GtkDragSource*                  m_pDragSource;
     bool                            m_bGeometryIsProvisional;
 +    bool                            m_bIconSetWhileUnmapped;
     GtkSalMenu*                     m_pSalMenu;
@@ -315,6 +316,8 @@ class GtkSalFrame : public SalFrame
     void SetScreen( unsigned int nNewScreen, SetType eType, tools::Rectangle const *pSize = nullptr );
 +    void SetIcon(const char* pIcon);
 +
 public:
     cairo_surface_t*                m_pSurface;
     basegfx::B2IVector              m_aFrameSize;
 diff --git a/vcl/unx/gtk3/gtk3gtkframe.cxx b/vcl/unx/gtk3/gtk3gtkframe.cxx
 index 786aa40..624c75a 100644
 --- a/vcl/unx/gtk3/gtk3gtkframe.cxx
 +++ b/vcl/unx/gtk3/gtk3gtkframe.cxx
@@ -55,6 +55,7 @@
 #include <cstdlib>
 #include <cmath>
 +#include <dlfcn.h>
 #include <com/sun/star/accessibility/XAccessibleEditableText.hpp>
 #include <com/sun/star/awt/MouseButton.hpp>
@@ -922,6 +923,7 @@ void GtkSalFrame::InitCommon()
     m_pDropTarget       = nullptr;
     m_pDragSource       = nullptr;
     m_bGeometryIsProvisional = false;
 +    m_bIconSetWhileUnmapped = false;
     m_ePointerStyle     = static_cast<PointerStyle>(0xffff);
     m_pSalMenu          = nullptr;
     m_nWatcherId        = 0;
@@ -1217,6 +1219,28 @@ void GtkSalFrame::SetTitle( const OUString& rTitle )
     }
 }
 +void GtkSalFrame::SetIcon(const char* appicon)
 +{
 +    gtk_window_set_icon_name(GTK_WINDOW(m_pWindow), appicon);
 +
 +#if defined(GDK_WINDOWING_WAYLAND)
 +    if (DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()))
 +    {
 +        static auto set_application_id = reinterpret_cast<void (*) (GdkWindow*, const char*)>(
 +                                             dlsym(nullptr, "gdk_wayland_window_set_application_id"));
 +        if (set_application_id)
 +        {
 +            GdkWindow* gdkWindow = gtk_widget_get_window(m_pWindow);
 +            set_application_id(gdkWindow, appicon);
 +
 +            // gdk_wayland_window_set_application_id doesn't seem to work before
 +            // the window is mapped, so set this for real when/if we are mapped
 +            m_bIconSetWhileUnmapped = !gtk_widget_get_mapped(m_pWindow);
 +        }
 +    }
 +#endif
 +}
 +
 void GtkSalFrame::SetIcon( sal_uInt16 nIcon )
 {
     if( (m_nStyle & (SalFrameStyleFlags::PLUG|SalFrameStyleFlags::SYSTEMCHILD|SalFrameStyleFlags::FLOAT|SalFrameStyleFlags::INTRO|SalFrameStyleFlags::OWNERDRAWDECORATION))
@@ -1240,7 +1264,8 @@ void GtkSalFrame::SetIcon( sal_uInt16 nIcon )
     else
         appicon = g_strdup ("libreoffice-startcenter");
 -    gtk_window_set_icon_name (GTK_WINDOW (m_pWindow), appicon);
 +    SetIcon(appicon);
 +
     g_free (appicon);
 }
@@ -1309,13 +1334,18 @@ void GtkSalFrame::Show( bool bVisible, bool /*bNoActivate*/ )
             }
 #if defined(GDK_WINDOWING_WAYLAND)
 -            //rhbz#1334915, gnome#779143, tdf#100158
 -            //gtk under wayland lacks a way to change the app_id
 -            //of a window, so brute force everything as a
 -            //startcenter when initially shown to at least get
 -            //the default LibreOffice icon and not the broken
 -            //app icon
 -            if (DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()))
 +            /*
 +             rhbz#1334915, gnome#779143, tdf#100158
 +             https://gitlab.gnome.org/GNOME/gtk/-/issues/767
 +
 +             before gdk_wayland_window_set_application_id was available gtk
 +             under wayland lacked a way to change the app_id of a window, so
 +             brute force everything as a startcenter when initially shown to at
 +             least get the default LibreOffice icon and not the broken app icon
 +            */
 +            static bool bAppIdImmutable = DLSYM_GDK_IS_WAYLAND_DISPLAY(getGdkDisplay()) &&
 +                                          !dlsym(nullptr, "gdk_wayland_window_set_application_id");
 +            if (bAppIdImmutable)
             {
                 OString sOrigName(g_get_prgname());
                 g_set_prgname("libreoffice-startcenter");
@@ -3039,6 +3069,9 @@ gboolean GtkSalFrame::signalMap(GtkWidget *, GdkEvent*, gpointer frame)
 {
     GtkSalFrame* pThis = static_cast<GtkSalFrame*>(frame);
 +    if (pThis->m_bIconSetWhileUnmapped)
 +        pThis->SetIcon(gtk_window_get_icon_name(GTK_WINDOW(pThis->m_pWindow)));
 +
     pThis->CallCallbackExc( SalEvent::Resize, nullptr );
     pThis->TriggerPaintEvent();
 -- 
 2.26.2
--- a/SOURCES/0002-CVE-2021-25635.patch
+++ b/SOURCES/0002-CVE-2021-25635.patch
@ -0,0 +1,56 @@
 From a9102a384893fd084011e8451867071452031ece Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 8 Feb 2021 17:05:28 +0000
 Subject: [PATCH 2/6] CVE-2021-25635
 default to CertificateValidity::INVALID
 so if CertGetCertificateChain fails we don't want validity to be
 css::security::CertificateValidity::VALID which is what the old default
 of 0 equates to
 notably
 commit 1e0bc66d16aee28ce8bd9582ea32178c63841902
 Date:   Thu Nov 5 16:55:26 2009 +0100
    jl137:  #103420# better logging
 turned the nss equivalent of SecurityEnvironment_NssImpl::verifyCertificate
 from 0 to CertificateValidity::INVALID like this change does
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110561
 Tested-by: Jenkins
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit edeb164c1d8ab64116afee4e2140403a362a1358)
 Change-Id: I5350dbc22d1b9b378da2976d3b0abd728f1f4c27
 ---
 .../source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
 index d9b657891b96..4031df289f44 100644
 --- a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
 +++ b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
@@ -755,7 +755,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
     const uno::Reference< css::security::XCertificate >& aCert,
     const uno::Sequence< uno::Reference< css::security::XCertificate > >& seqCerts)
 {
 -    sal_Int32 validity = 0;
 +    sal_Int32 validity = css::security::CertificateValidity::INVALID;
     PCCERT_CHAIN_CONTEXT pChainContext = nullptr;
     PCCERT_CONTEXT pCertContext = nullptr;
@@ -899,7 +899,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
         }
         else
         {
 -            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChaine failed.");
 +            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChain failed.");
         }
     }
 -- 
 2.32.0
--- a/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
+++ b/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
@ -0,0 +1,198 @@
 From 61f8673fb44150bd629d88f6626aff8d5b026449 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Mon, 21 Mar 2022 20:58:34 +0000
 Subject: [PATCH] make hash encoding match decoding
 Seeing as old versions of the hash may be in the users config, add a
 StorageVersion field to the office config Passwords section which
 defaults to 0 to indicate the old hash is in use.
 Try the old varient when StorageVersion is 0. When a new encoded master
 password it set write StorageVersion of 1 to indicate a new hash is in
 use and use the new style when StorageVersion is 1.
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)
 svl: fix crash if user cancels/closes master password dialog
 (regression from d7ba5614d90381d68f880ca7e7c5ef8bbb1b1c43)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133932
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit bbb8617ece6d946957c2eb96287081029bce530f)
 Change-Id: I3174c37a5891bfc849984e0ec5c2c392b9c6e7b1
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133905
 Tested-by: Michael Stahl <michael.stahl@allotropia.de>
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 ---
 .../schema/org/openoffice/Office/Common.xcs   |  6 +++
 .../passwordcontainer/passwordcontainer.cxx   | 47 ++++++++++++++++++-
 .../passwordcontainer/passwordcontainer.hxx   |  6 +++
 uui/source/iahndl-authentication.cxx          |  5 +-
 4 files changed, 60 insertions(+), 4 deletions(-)
 diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 index b317f616deeb..b033b29b60d7 100644
 --- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 +++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
@@ -911,6 +911,12 @@
         </info>
         <value>false</value>
       </prop>
 +      <prop oor:name="StorageVersion" oor:type="xs:int" oor:nillable="false">
 +        <info>
 +          <desc>Specifies what version of encoding scheme the password container uses.</desc>
 +        </info>
 +        <value>0</value>
 +      </prop>
       <prop oor:name="HasMaster" oor:type="xs:boolean" oor:nillable="false">
         <info>
           <desc>Specifies if there is a valid master password.</desc>
 diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
 index 02947cd3892c..ff0b40df4016 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.cxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.cxx
@@ -17,6 +17,8 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 +#include <sal/config.h>
 +#include <sal/log.hxx>
 #include "passwordcontainer.hxx"
@@ -259,6 +261,23 @@ bool StorageItem::useStorage()
     return aResult;
 }
 +sal_Int32 StorageItem::getStorageVersion()
 +{
 +    Sequence<OUString> aNodeNames { "StorageVersion" };
 +
 +    Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
 +
 +    if( aPropertyValues.getLength() != aNodeNames.getLength() )
 +    {
 +        OSL_FAIL( "Problems during reading" );
 +        return 0;
 +    }
 +
 +    sal_Int32 nResult = 0;
 +    aPropertyValues[0] >>= nResult;
 +
 +    return nResult;
 +}
 bool StorageItem::getEncodedMP( OUString& aResult )
 {
@@ -291,15 +310,17 @@ bool StorageItem::getEncodedMP( OUString& aResult )
 void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
 {
 -    Sequence< OUString > sendNames(2);
 -    Sequence< uno::Any > sendVals(2);
 +    Sequence< OUString > sendNames(3);
 +    Sequence< uno::Any > sendVals(3);
     sendNames[0] = "HasMaster";
     sendNames[1] = "Master";
 +    sendNames[2] = "StorageVersion";
     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
     sendVals[0] <<= bHasMaster;
     sendVals[1] <<= aEncoded;
 +    sendVals[2] <<= nCurrentStorageVersion;
     ConfigItem::SetModified();
     ConfigItem::PutProperties( sendNames, sendVals );
@@ -800,6 +821,18 @@ OUString PasswordContainer::RequestPasswordFromUser( PasswordRequestMode aRMode,
     return aResult;
 }
 +// Mangle the key to match an old bug
 +static OUString ReencodeAsOldHash(const OUString& rPass)
 +{
 +    OUStringBuffer aBuffer;
 +    for (int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ++ind)
 +    {
 +        unsigned char i = static_cast<char>(rPass.copy(ind * 2, 2).toUInt32(16));
 +        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
 +        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
 +    }
 +    return aBuffer.makeStringAndClear();
 +}
 OUString const & PasswordContainer::GetMasterPassword( const Reference< XInteractionHandler >& aHandler )
 {
@@ -838,6 +871,9 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
                     }
                     else
                     {
 +                        if (m_pStorageFile->getStorageVersion() == 0)
 +                            aPass = ReencodeAsOldHash(aPass);
 +
                         std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
                         if( aRM.empty() || aPass != aRM[0] )
                         {
@@ -1042,6 +1078,13 @@ sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::R
                 do {
                     aPass = RequestPasswordFromUser( aRMode, xTmpHandler );
 +
 +
 +                    if (!aPass.isEmpty() && m_pStorageFile->getStorageVersion() == 0)
 +                    {
 +                        aPass = ReencodeAsOldHash(aPass);
 +                    }
 +
                     bResult = ( !aPass.isEmpty() && aPass == m_aMasterPasswd );
                     aRMode = PasswordRequestMode_PASSWORD_REENTER; // further questions with error notification
                 } while( !bResult && !aPass.isEmpty() );
 diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
 index 09fb7e03629d..cf5c717d0c9e 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.hxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.hxx
@@ -167,6 +167,10 @@ public:
 typedef ::std::pair< const OUString, ::std::vector< NamePassRecord > > PairUrlRecord;
 typedef ::std::map< OUString, ::std::vector< NamePassRecord > > PassMap;
 +// org.openoffice.Office.Common/Passwords/StorageVersion bump if details of
 +// how password details are saved changes. Enables migration from previous
 +// schemes.
 +constexpr sal_Int32 nCurrentStorageVersion = 1;
 class PasswordContainer;
@@ -195,6 +199,8 @@ public:
     void remove( const OUString& url, const OUString& rec );
     void clear();
 +    sal_Int32 getStorageVersion();
 +
     bool getEncodedMP( OUString& aResult );
     void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
     void setUseStorage( bool bUse );
 diff --git a/uui/source/iahndl-authentication.cxx b/uui/source/iahndl-authentication.cxx
 index 4835a485dd2a..5764e62cb1c6 100644
 --- a/uui/source/iahndl-authentication.cxx
 +++ b/uui/source/iahndl-authentication.cxx
@@ -436,8 +436,9 @@ executeMasterPasswordDialog(
     OUStringBuffer aBuffer;
     for (sal_uInt8 i : aKey)
     {
 -        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
 -        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
 +        // match PasswordContainer::DecodePasswords aMasterPasswd.copy(index * 2, 2).toUInt32(16));
 +        aBuffer.append(OUString::number(i >> 4, 16));
 +        aBuffer.append(OUString::number(i & 15, 16));
     }
     rInfo.SetPassword(aBuffer.makeStringAndClear());
 }
 -- 
 2.37.1
--- a/SOURCES/0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch
+++ b/SOURCES/0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch
@ -0,0 +1,87 @@
 From 99b453dfac5ed44a02c6e1a51b871ee50709a405 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Sat, 4 Nov 2023 19:57:51 +0000
 Subject: [PATCH] warn about exotic protocols as well
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151834
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 1305f70cff8a81a58a5a6d9c96c5bb032005389e)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159034
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159881
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159911
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 erAck: backported to 6.4.7.2
 ---
 sw/source/filter/html/htmlplug.cxx | 2 +-
 sw/source/filter/xml/xmltexti.cxx  | 2 +-
 tools/source/fsys/urlobj.cxx       | 3 ++-
 xmloff/source/draw/ximpshap.cxx    | 2 +-
 4 files changed, 5 insertions(+), 4 deletions(-)
 diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
 index eb70704..112975f 100644
 --- a/sw/source/filter/html/htmlplug.cxx
 +++ b/sw/source/filter/html/htmlplug.cxx
@@ -1089,7 +1089,7 @@ void SwHTMLParser::InsertFloatingFrame()
                 OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
 -                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
 +                if (INetURLObject(sHRef).IsExoticProtocol())
                     NotifyMacroEventRead();
                 xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
 diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
 index 72a14b9..e015575 100644
 --- a/sw/source/filter/xml/xmltexti.cxx
 +++ b/sw/source/filter/xml/xmltexti.cxx
@@ -856,7 +856,7 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
                 OUString sHRef = URIHelper::SmartRel2Abs(
                             INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
 -                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
 +                if (INetURLObject(sHRef).IsExoticProtocol())
                     GetXMLImport().NotifyMacroEventRead();
                 xSet->setPropertyValue("FrameURL",
 diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
 index ab6e885..1ef2b7e 100644
 --- a/tools/source/fsys/urlobj.cxx
 +++ b/tools/source/fsys/urlobj.cxx
@@ -4776,7 +4776,8 @@ bool INetURLObject::IsExoticProtocol() const
     return m_eScheme == INetProtocol::Slot ||
            m_eScheme == INetProtocol::Macro ||
            m_eScheme == INetProtocol::Uno ||
 -           isSchemeEqualTo(u"vnd.sun.star.script");
 +           isSchemeEqualTo(u"vnd.sun.star.script") ||
 +           isSchemeEqualTo(u"service");
 }
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
 index bd5f30a..b58da79 100644
 --- a/xmloff/source/draw/ximpshap.cxx
 +++ b/xmloff/source/draw/ximpshap.cxx
@@ -3269,7 +3269,7 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
             if( !maHref.isEmpty() )
             {
 -                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
 +                if (INetURLObject(maHref).IsExoticProtocol())
                     GetImport().NotifyMacroEventRead();
                 xProps->setPropertyValue("FrameURL", Any(maHref) );
 -- 
 2.43.0
--- a/SOURCES/0002-Related-rhbz-1618703-Properly-handle-failure-encodin.patch
+++ b/SOURCES/0002-Related-rhbz-1618703-Properly-handle-failure-encodin.patch
@ -1,124 +0,0 @@
 From 0df85fe6a19d90d73397f8006c62d61e96976817 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Thu, 23 Aug 2018 16:55:40 +0200
 Subject: [PATCH 2/5] Related rhbz#1618703: Properly handle failure encoding
 zip file
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...when e.g. FIPS mode makes ZipFile::StaticGetCipher fail by throwing an
 exception which would be caught by ZipPackageStream::saveChild (in
 package/source/zippackage/ZipPackageStream.cxx) alright (and translated into
 bSuccess = false), if ZipFile::StaticGetCipher didn't unhelpfully swallow and
 ignore all exceptions in an outer try-catch.
 Change-Id: I14376128515df1dd4bdac921edd8ab94cc9b7617
 Reviewed-on: https://gerrit.libreoffice.org/59514
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 3cc6d3611ac8cbbfb9803f3a084d02edde470ad3)
 Reviewed-on: https://gerrit.libreoffice.org/59569
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 2b5ff36afab8888cdbc879ae2f34903ede190c04)
 ---
 package/source/zipapi/ZipFile.cxx | 75 ++++++++++++++-----------------
 1 file changed, 34 insertions(+), 41 deletions(-)
 diff --git a/package/source/zipapi/ZipFile.cxx b/package/source/zipapi/ZipFile.cxx
 index 1ef81bf582a5..8126ebba305b 100644
 --- a/package/source/zipapi/ZipFile.cxx
 +++ b/package/source/zipapi/ZipFile.cxx
@@ -162,54 +162,47 @@ uno::Reference< xml::crypto::XCipherContext > ZipFile::StaticGetCipher( const un
 {
     uno::Reference< xml::crypto::XCipherContext > xResult;
 -    try
 +    if (xEncryptionData->m_nDerivedKeySize < 0)
     {
 -        if (xEncryptionData->m_nDerivedKeySize < 0)
 -        {
 -            throw ZipIOException("Invalid derived key length!" );
 -        }
 +        throw ZipIOException("Invalid derived key length!" );
 +    }
 -        uno::Sequence< sal_Int8 > aDerivedKey( xEncryptionData->m_nDerivedKeySize );
 -        if ( !xEncryptionData->m_nIterationCount &&
 -             xEncryptionData->m_nDerivedKeySize == xEncryptionData->m_aKey.getLength() )
 -        {
 -            // gpg4libre: no need to derive key, m_aKey is already
 -            // usable as symmetric session key
 -            aDerivedKey = xEncryptionData->m_aKey;
 -        }
 -        else if ( rtl_Digest_E_None != rtl_digest_PBKDF2( reinterpret_cast< sal_uInt8* >( aDerivedKey.getArray() ),
 -                            aDerivedKey.getLength(),
 -                            reinterpret_cast< const sal_uInt8 * > (xEncryptionData->m_aKey.getConstArray() ),
 -                            xEncryptionData->m_aKey.getLength(),
 -                            reinterpret_cast< const sal_uInt8 * > ( xEncryptionData->m_aSalt.getConstArray() ),
 -                            xEncryptionData->m_aSalt.getLength(),
 -                            xEncryptionData->m_nIterationCount ) )
 -        {
 -            throw ZipIOException("Can not create derived key!" );
 -        }
 +    uno::Sequence< sal_Int8 > aDerivedKey( xEncryptionData->m_nDerivedKeySize );
 +    if ( !xEncryptionData->m_nIterationCount &&
 +         xEncryptionData->m_nDerivedKeySize == xEncryptionData->m_aKey.getLength() )
 +    {
 +        // gpg4libre: no need to derive key, m_aKey is already
 +        // usable as symmetric session key
 +        aDerivedKey = xEncryptionData->m_aKey;
 +    }
 +    else if ( rtl_Digest_E_None != rtl_digest_PBKDF2( reinterpret_cast< sal_uInt8* >( aDerivedKey.getArray() ),
 +                        aDerivedKey.getLength(),
 +                        reinterpret_cast< const sal_uInt8 * > (xEncryptionData->m_aKey.getConstArray() ),
 +                        xEncryptionData->m_aKey.getLength(),
 +                        reinterpret_cast< const sal_uInt8 * > ( xEncryptionData->m_aSalt.getConstArray() ),
 +                        xEncryptionData->m_aSalt.getLength(),
 +                        xEncryptionData->m_nIterationCount ) )
 +    {
 +        throw ZipIOException("Can not create derived key!" );
 +    }
 -        if ( xEncryptionData->m_nEncAlg == xml::crypto::CipherID::AES_CBC_W3C_PADDING )
 -        {
 -            uno::Reference< uno::XComponentContext > xContext = xArgContext;
 -            if ( !xContext.is() )
 -                xContext = comphelper::getProcessComponentContext();
 +    if ( xEncryptionData->m_nEncAlg == xml::crypto::CipherID::AES_CBC_W3C_PADDING )
 +    {
 +        uno::Reference< uno::XComponentContext > xContext = xArgContext;
 +        if ( !xContext.is() )
 +            xContext = comphelper::getProcessComponentContext();
 -            uno::Reference< xml::crypto::XNSSInitializer > xCipherContextSupplier = xml::crypto::NSSInitializer::create( xContext );
 +        uno::Reference< xml::crypto::XNSSInitializer > xCipherContextSupplier = xml::crypto::NSSInitializer::create( xContext );
 -            xResult = xCipherContextSupplier->getCipherContext( xEncryptionData->m_nEncAlg, aDerivedKey, xEncryptionData->m_aInitVector, bEncrypt, uno::Sequence< beans::NamedValue >() );
 -        }
 -        else if ( xEncryptionData->m_nEncAlg == xml::crypto::CipherID::BLOWFISH_CFB_8 )
 -        {
 -            xResult = BlowfishCFB8CipherContext::Create( aDerivedKey, xEncryptionData->m_aInitVector, bEncrypt );
 -        }
 -        else
 -        {
 -            throw ZipIOException("Unknown cipher algorithm is requested!" );
 -        }
 +        xResult = xCipherContextSupplier->getCipherContext( xEncryptionData->m_nEncAlg, aDerivedKey, xEncryptionData->m_aInitVector, bEncrypt, uno::Sequence< beans::NamedValue >() );
     }
 -    catch( ... )
 +    else if ( xEncryptionData->m_nEncAlg == xml::crypto::CipherID::BLOWFISH_CFB_8 )
 +    {
 +        xResult = BlowfishCFB8CipherContext::Create( aDerivedKey, xEncryptionData->m_aInitVector, bEncrypt );
 +    }
 +    else
     {
 -        OSL_ENSURE( false, "Can not create cipher context!" );
 +        throw ZipIOException("Unknown cipher algorithm is requested!" );
     }
     return xResult;
 -- 
 2.17.1
--- a/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
+++ b/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
@ -0,0 +1,82 @@
 From c0e926365dc7651dcb5eee48f50e6990523662ad Mon Sep 17 00:00:00 2001
 From: Eike Rathke <erack@redhat.com>
 Date: Fri, 17 Feb 2023 12:03:54 +0100
 Subject: [PATCH 2/3] Stack check safety belt before fishing in muddy waters
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Have it hit hard in debug builds.
 Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147245
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 166a07062dd4ffedca6106f439a6fcddaeee5eb5)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147391
 Tested-by: Michael Stahl <michael.stahl@allotropia.de>
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit f8efb098f2abbf054a15dcf7daaaacfa575685ae)
 ---
 sc/source/core/inc/interpre.hxx  | 12 ++++++++++++
 sc/source/core/tool/interpr1.cxx |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)
 diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
 index 3b902524d901..c7d4527dbf57 100644
 --- a/sc/source/core/inc/interpre.hxx
 +++ b/sc/source/core/inc/interpre.hxx
@@ -235,6 +235,7 @@ private:
     inline bool MustHaveParamCount( short nAct, short nMust );
     inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
     inline bool MustHaveParamCountMin( short nAct, short nMin );
 +    inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
     void PushParameterExpected();
     void PushIllegalParameter();
     void PushIllegalArgument();
@@ -1086,6 +1087,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin )
     return false;
 }
 +inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin )
 +{
 +    assert(sp >= nAct);
 +    if (sp < nAct)
 +    {
 +        PushParameterExpected();
 +        return false;
 +    }
 +    return MustHaveParamCountMin( nAct, nMin);
 +}
 +
 inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
 {
     if (!rtl::math::isFinite( fVal))
 diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
 index e375f1626ec5..4b093cb62d4f 100644
 --- a/sc/source/core/tool/interpr1.cxx
 +++ b/sc/source/core/tool/interpr1.cxx
@@ -7524,7 +7524,7 @@ void ScInterpreter::ScVLookup()
 void ScInterpreter::ScSubTotal()
 {
     sal_uInt8 nParamCount = GetByte();
 -    if ( MustHaveParamCountMin( nParamCount, 2 ) )
 +    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
     {
         // We must fish the 1st parameter deep from the stack! And push it on top.
         const FormulaToken* p = pStack[ sp - nParamCount ];
@@ -7571,7 +7571,7 @@ void ScInterpreter::ScSubTotal()
 void ScInterpreter::ScAggregate()
 {
     sal_uInt8 nParamCount = GetByte();
 -    if ( MustHaveParamCountMin( nParamCount, 3 ) )
 +    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
     {
         // fish the 1st parameter from the stack and push it on top.
         const FormulaToken* p = pStack[ sp - nParamCount ];
 -- 
 2.41.0
--- a/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
+++ b/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
@ -0,0 +1,907 @@
 From 0ea515e760325b3d9f33824e917d0d549f4509e4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 13 Apr 2023 11:31:17 +0100
 Subject: [PATCH 2/3] put floating frames under managed links control
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 like we do for sections and ole objects that link to their content
 individual commits in trunk are:
 extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse
 no behaviour change intended
 Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825)
 use parent window as dialog parent
 it makes no odds, but is more convenient for upcoming modification
 Change-Id: Ibc5333b137d2da089b3b701ff615c6ddf43063d0
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99)
 adjust IFrameObject so it could reuse mxFrame for a reload of content
 Change-Id: I7eec3132a23faafd9a2878215a0a117a67bc9bf2
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206)
 query getUserAllowsLinkUpdate for the case of content in a floating frame
 similarly to how it works for the more common "normal" embedded objects
 Change-Id: I83e38dfa2f84907c2de9680e91f779d34864a9ad
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7)
 add a route to get writer Floating Frame links under 'manage links'
 Change-Id: If90ff71d6a96342574799312f764badaf97980eb
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be)
 allow SvxOle2Shape::resetModifiedState to survive having no SdrObject
 Change-Id: Iea059262c124e3f44249e49b4189732310d28156
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c)
 create the FloatingFrameShape in a separate step to inserting it
 this is derived from the path taken by the AddShape(const OUString&)
 function for this case. No change in behavior is intended.
 Change-Id: Id09ae0c65a55a37743ad7c184070fb8dd97d8a7f
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024)
 add a route to get calc Floating Frame links under 'manage links'
 much harder than writer because the organization and ordering
 of properties and object activation etc is different.
 This ended up ugly, but functions.
 We set FrameURL before AddShape, we have to do it again later because it
 gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
 FrameURL to exist when AddShape triggers SetPersistName which itself
 triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
 know what URL will end up being used. So bodge this by setting FrameURL
 to the temp pre-SdrOle2Obj attached properties and we can smuggle it
 eventually into SdrOle2Obj::SetPersistName at the right point after
 PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
 in order to inform the link manager that this is an IFrame that links to
 a URL
 Change-Id: I67fc199fef9e67fa12ca7873f0fe12137aa16d8f
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit b91ea614c0b753ab3d378acd0e2db8262e9dbd72)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151107
 Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
 Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
 (cherry picked from commit 8b35b17ffaab23d72ddec2d9f41be0e30fcaa6c4)
 Conflicts:
 	embeddedobj/source/commonembedding/specialobject.cxx
 	embeddedobj/source/inc/specialobject.hxx
 	include/svx/svdoole2.hxx
 	sfx2/source/doc/iframe.cxx
 	svx/source/svdraw/svdoole2.cxx
 	sw/source/core/ole/ndole.cxx
 	xmloff/source/draw/ximpshap.cxx
 ---
 .../source/commonembedding/embedobj.cxx       |  60 +++++-----
 .../source/commonembedding/specialobject.cxx  |   9 ++
 embeddedobj/source/inc/commonembobj.hxx       |   3 +
 embeddedobj/source/inc/specialobject.hxx      |   6 +
 include/svx/svdoole2.hxx                      |  17 ++-
 include/svx/unoshape.hxx                      |   2 +
 sc/source/ui/docshell/documentlinkmgr.cxx     |   9 +-
 sfx2/source/doc/iframe.cxx                    |  55 +++++----
 svx/source/svdraw/svdoole2.cxx                | 104 ++++++++++++++----
 svx/source/unodraw/shapeimpl.hxx              |   5 +
 svx/source/unodraw/unoshap4.cxx               |  23 +++-
 sw/inc/ndole.hxx                              |   4 +-
 sw/source/core/ole/ndole.cxx                  |  89 ++++++++++++--
 xmloff/source/draw/ximpshap.cxx               |  29 ++++-
 xmloff/source/draw/ximpshap.hxx               |   2 +
 15 files changed, 335 insertions(+), 90 deletions(-)
 diff --git a/embeddedobj/source/commonembedding/embedobj.cxx b/embeddedobj/source/commonembedding/embedobj.cxx
 index e6e5bec2a3160..b402dff22042a 100644
 --- a/embeddedobj/source/commonembedding/embedobj.cxx
 +++ b/embeddedobj/source/commonembedding/embedobj.cxx
@@ -155,6 +155,37 @@ void OCommonEmbeddedObject::StateChangeNotification_Impl( bool bBeforeChange, sa
     }
 }
 +void OCommonEmbeddedObject::SetInplaceActiveState()
 +{
 +    if ( !m_xClientSite.is() )
 +        throw embed::WrongStateException( "client site not set, yet", *this );
 +
 +    uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
 +    if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
 +        throw embed::WrongStateException(); //TODO: can't activate inplace
 +    xInplaceClient->activatingInplace();
 +
 +    uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
 +
 +    m_xClientWindow = xClientWindowSupplier->getWindow();
 +    m_aOwnRectangle = xInplaceClient->getPlacement();
 +    m_aClipRectangle = xInplaceClient->getClipRectangle();
 +    awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
 +
 +    // create own window based on the client window
 +    // place and resize the window according to the rectangles
 +    uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
 +
 +    // dispatch provider may not be provided
 +    uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
 +    bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
 +    m_nObjectState = embed::EmbedStates::INPLACE_ACTIVE;
 +    if ( !bOk )
 +    {
 +        SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
 +        throw embed::WrongStateException(); //TODO: can't activate inplace
 +    }
 +}
 void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
 {
@@ -228,34 +259,7 @@ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
         {
             if ( nNextState == embed::EmbedStates::INPLACE_ACTIVE )
             {
 -                if ( !m_xClientSite.is() )
 -                    throw embed::WrongStateException( "client site not set, yet", *this );
 -
 -                uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
 -                if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
 -                    throw embed::WrongStateException(); //TODO: can't activate inplace
 -                xInplaceClient->activatingInplace();
 -
 -                uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
 -
 -                m_xClientWindow = xClientWindowSupplier->getWindow();
 -                m_aOwnRectangle = xInplaceClient->getPlacement();
 -                m_aClipRectangle = xInplaceClient->getClipRectangle();
 -                awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
 -
 -                // create own window based on the client window
 -                // place and resize the window according to the rectangles
 -                uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
 -
 -                // dispatch provider may not be provided
 -                uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
 -                bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
 -                m_nObjectState = nNextState;
 -                if ( !bOk )
 -                {
 -                    SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
 -                    throw embed::WrongStateException(); //TODO: can't activate inplace
 -                }
 +                SetInplaceActiveState();
             }
             else if ( nNextState == embed::EmbedStates::ACTIVE )
             {
 diff --git a/embeddedobj/source/commonembedding/specialobject.cxx b/embeddedobj/source/commonembedding/specialobject.cxx
 index 683fe0aab3f25..c17a39accf2c7 100644
 --- a/embeddedobj/source/commonembedding/specialobject.cxx
 +++ b/embeddedobj/source/commonembedding/specialobject.cxx
@@ -47,6 +47,7 @@ uno::Any SAL_CALL OSpecialEmbeddedObject::queryInterface( const uno::Type& rType
     uno::Any aReturn = ::cppu::queryInterface( rType,
                                         static_cast< embed::XEmbeddedObject* >( this ),
                                         static_cast< embed::XInplaceObject* >( this ),
 +                                        static_cast< embed::XCommonEmbedPersist* >( static_cast< embed::XEmbedPersist* >( this ) ),
                                         static_cast< embed::XVisualObject* >( this ),
                                         static_cast< embed::XClassifiedObject* >( this ),
                                         static_cast< embed::XComponentSupplier* >( this ),
@@ -160,4 +161,12 @@ void SAL_CALL OSpecialEmbeddedObject::doVerb( sal_Int32 nVerbID )
         OCommonEmbeddedObject::doVerb( nVerbID );
 }
 +void SAL_CALL OSpecialEmbeddedObject::reload(
 +                const uno::Sequence< beans::PropertyValue >&,
 +                const uno::Sequence< beans::PropertyValue >&)
 +{
 +    // Allow IFrames to reload their content
 +    SetInplaceActiveState();
 +}
 +
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/embeddedobj/source/inc/commonembobj.hxx b/embeddedobj/source/inc/commonembobj.hxx
 index b2c9acd9ec1e7..73282a00deac4 100644
 --- a/embeddedobj/source/inc/commonembobj.hxx
 +++ b/embeddedobj/source/inc/commonembobj.hxx
@@ -226,6 +226,9 @@ private:
                     const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
                     const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs );
 +protected:
 +    void SetInplaceActiveState();
 +
 public:
     OCommonEmbeddedObject(
         const css::uno::Reference< css::uno::XComponentContext >& rxContext,
 diff --git a/embeddedobj/source/inc/specialobject.hxx b/embeddedobj/source/inc/specialobject.hxx
 index 32ad61a7a5828..ce5c01b35ae7f 100644
 --- a/embeddedobj/source/inc/specialobject.hxx
 +++ b/embeddedobj/source/inc/specialobject.hxx
@@ -48,6 +48,12 @@ public:
     virtual void SAL_CALL changeState( sal_Int32 nNewState ) override;
     virtual void SAL_CALL doVerb( sal_Int32 nVerbID ) override;
 +
 +// XCommonEmbedPersist
 +
 +    virtual void SAL_CALL reload(
 +                const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
 +                const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs ) override;
 };
 #endif
 diff --git a/include/svx/svdoole2.hxx b/include/svx/svdoole2.hxx
 index b192a438bc190..da5f094ab1553 100644
 --- a/include/svx/svdoole2.hxx
 +++ b/include/svx/svdoole2.hxx
@@ -42,6 +42,7 @@ namespace frame { class XModel; }
 namespace svt { class EmbeddedObjectRef; }
 class SdrOle2ObjImpl;
 +class SvxOle2Shape;
 class SVX_DLLPUBLIC SdrOle2Obj : public SdrRectObj
 {
@@ -49,7 +50,7 @@ private:
     std::unique_ptr<SdrOle2ObjImpl> mpImpl;
 private:
 -    SVX_DLLPRIVATE void Connect_Impl();
 +    SVX_DLLPRIVATE void Connect_Impl(SvxOle2Shape* pCreator = nullptr);
     SVX_DLLPRIVATE void Disconnect_Impl();
     SVX_DLLPRIVATE void AddListeners_Impl();
     SVX_DLLPRIVATE void RemoveListeners_Impl();
@@ -105,7 +106,7 @@ public:
     // OLE object has got a separate PersistName member now;
     // !!! use ::SetPersistName( ... ) only, if you know what you do !!!
     const OUString& GetPersistName() const;
 -    void        SetPersistName( const OUString& rPersistName );
 +    void        SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator = nullptr );
     // One can add an application name to a SdrOle2Obj, which can be queried for
     // later on (SD needs this for presentation objects).
@@ -153,7 +154,7 @@ public:
                                          sal_Int64 nAspect );
     static bool Unload( const css::uno::Reference< css::embed::XEmbeddedObject >& xObj, sal_Int64 nAspect );
     bool Unload();
 -    void Connect();
 +    void Connect(SvxOle2Shape* pCreator = nullptr);
     void Disconnect();
     void ObjectLoaded();
@@ -200,6 +201,16 @@ public:
     void                Connect() { GetRealObject(); }
 };
 +class SVX_DLLPUBLIC SdrIFrameLink final : public sfx2::SvBaseLink
 +{
 +    SdrOle2Obj* m_pObject;
 +
 +public:
 +    explicit SdrIFrameLink(SdrOle2Obj* pObject);
 +    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
 +        const OUString& rMimeType, const css::uno::Any & rValue ) override;
 +};
 +
 #endif // INCLUDED_SVX_SVDOOLE2_HXX
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
 diff --git a/include/svx/unoshape.hxx b/include/svx/unoshape.hxx
 index 0b48d1e433d6e..712552a55281a 100644
 --- a/include/svx/unoshape.hxx
 +++ b/include/svx/unoshape.hxx
@@ -597,6 +597,8 @@ public:
     bool createObject( const SvGlobalName &aClassName );
     void createLink( const OUString& aLinkURL );
 +
 +    virtual OUString GetAndClearInitialFrameURL();
 };
 diff --git a/sc/source/ui/docshell/documentlinkmgr.cxx b/sc/source/ui/docshell/documentlinkmgr.cxx
 index cb3467c8bb691..8ea3c2cce5fb4 100644
 --- a/sc/source/ui/docshell/documentlinkmgr.cxx
 +++ b/sc/source/ui/docshell/documentlinkmgr.cxx
@@ -142,7 +142,7 @@ bool DocumentLinkManager::hasDdeOrOleOrWebServiceLinks(bool bDde, bool bOle, boo
         sfx2::SvBaseLink* pBase = rLink.get();
         if (bDde && dynamic_cast<ScDdeLink*>(pBase))
             return true;
 -        if (bOle && dynamic_cast<SdrEmbedObjectLink*>(pBase))
 +        if (bOle && (dynamic_cast<SdrEmbedObjectLink*>(pBase) || dynamic_cast<SdrIFrameLink*>(pBase)))
             return true;
         if (bWebService && dynamic_cast<ScWebServiceLink*>(pBase))
             return true;
@@ -173,6 +173,13 @@ bool DocumentLinkManager::updateDdeOrOleOrWebServiceLinks(weld::Window* pWin)
             continue;
         }
 +        SdrIFrameLink* pIFrameLink = dynamic_cast<SdrIFrameLink*>(pBase);
 +        if (pIFrameLink)
 +        {
 +            pIFrameLink->Update();
 +            continue;
 +        }
 +
         ScWebServiceLink* pWebserviceLink = dynamic_cast<ScWebServiceLink*>(pBase);
         if (pWebserviceLink)
         {
 diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
 index 5a0ea96a234da..fce6cb48ea08f 100644
 --- a/sfx2/source/doc/iframe.cxx
 +++ b/sfx2/source/doc/iframe.cxx
@@ -177,31 +177,46 @@ sal_Bool SAL_CALL IFrameObject::load(
                 return false;
         }
 +        bool bUpdateAllowed(true);
 +        if (pDoc)
 +        {
 +            // perhaps should only check for file targets, but lets default to making it strong
 +            // unless there is a known need to distinguish
 +            comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
 +            bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
 +        }
 +        if (!bUpdateAllowed)
 +            return false;
 +
         OUString sReferer;
         if (pDoc && pDoc->HasName())
             sReferer = pDoc->GetMedium()->GetName();
 -        DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
 -        VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
 -        VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
 -        pWin->SetSizePixel( pParent->GetOutputSizePixel() );
 -        pWin->SetBackground();
 -        pWin->Show();
 -
 -        uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
 -        xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
 +        uno::Reference<css::awt::XWindow> xParentWindow(xFrame->getContainerWindow());
 -        // we must destroy the IFrame before the parent is destroyed
 -        xWindow->addEventListener( this );
 -
 -        mxFrame = frame::Frame::create( mxContext );
 -        uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
 -        mxFrame->initialize( xWin );
 -        mxFrame->setName( maFrmDescr.GetName() );
 -
 -        uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
 -        if ( xFramesSupplier.is() )
 -            mxFrame->setCreator( xFramesSupplier );
 +        if (!mxFrame.is())
 +        {
 +            VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow(xParentWindow);
 +            VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
 +            pWin->SetSizePixel( pParent->GetOutputSizePixel() );
 +            pWin->SetBackground();
 +            pWin->Show();
 +
 +            uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
 +            xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
 +
 +            // we must destroy the IFrame before the parent is destroyed
 +            xWindow->addEventListener( this );
 +
 +            mxFrame = frame::Frame::create( mxContext );
 +            uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
 +            mxFrame->initialize( xWin );
 +            mxFrame->setName( maFrmDescr.GetName() );
 +
 +            uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
 +            if ( xFramesSupplier.is() )
 +                mxFrame->setCreator( xFramesSupplier );
 +        }
         uno::Sequence < beans::PropertyValue > aProps{
             comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
 diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
 index 16617ecaf94fe..dc5f74811723d 100644
 --- a/svx/source/svdraw/svdoole2.cxx
 +++ b/svx/source/svdraw/svdoole2.cxx
@@ -78,6 +78,7 @@
 #include <sdr/contact/viewcontactofsdrole2obj.hxx>
 #include <svx/svdograf.hxx>
 #include <sdr/properties/oleproperties.hxx>
 +#include <svx/unoshape.hxx>
 #include <svx/xlineit0.hxx>
 #include <svx/xlnclit.hxx>
 #include <svx/xbtmpit.hxx>
@@ -598,6 +599,35 @@ void SdrEmbedObjectLink::Closed()
     SvBaseLink::Closed();
 }
 +SdrIFrameLink::SdrIFrameLink(SdrOle2Obj* pObject)
 +    : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
 +    , m_pObject(pObject)
 +{
 +    SetSynchron( false );
 +}
 +
 +::sfx2::SvBaseLink::UpdateResult SdrIFrameLink::DataChanged(
 +    const OUString&, const uno::Any& )
 +{
 +    uno::Reference<embed::XEmbeddedObject> xObject = m_pObject->GetObjRef();
 +    uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
 +    if (xPersObj.is())
 +    {
 +        // let the IFrameObject reload the link
 +        try
 +        {
 +            xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
 +        }
 +        catch (const uno::Exception&)
 +        {
 +        }
 +
 +        m_pObject->SetChanged();
 +    }
 +
 +    return SUCCESS;
 +}
 +
 class SdrOle2ObjImpl
 {
 public:
@@ -615,7 +645,7 @@ public:
     bool mbLoadingOLEObjectFailed:1; // New local var to avoid repeated loading if load of OLE2 fails
     bool mbConnected:1;
 -    SdrEmbedObjectLink* mpObjectLink;
 +    sfx2::SvBaseLink* mpObjectLink;
     OUString maLinkURL;
     rtl::Reference<SvxUnoShapeModifyListener> mxModifyListener;
@@ -815,7 +845,7 @@ bool SdrOle2Obj::IsEmpty() const
     return !mpImpl->mxObjRef.is();
 }
 -void SdrOle2Obj::Connect()
 +void SdrOle2Obj::Connect(SvxOle2Shape* pCreator)
 {
     if( IsEmptyPresObj() )
         return;
@@ -828,7 +858,7 @@ void SdrOle2Obj::Connect()
         return;
     }
 -    Connect_Impl();
 +    Connect_Impl(pCreator);
     AddListeners_Impl();
 }
@@ -927,24 +957,51 @@ void SdrOle2Obj::CheckFileLink_Impl()
     {
         try
         {
 -            uno::Reference< embed::XLinkageSupport > xLinkSupport( mpImpl->mxObjRef.GetObject(), uno::UNO_QUERY );
 +            uno::Reference<embed::XEmbeddedObject> xObject = mpImpl->mxObjRef.GetObject();
 +            if (!xObject)
 +                return;
 -            if ( xLinkSupport.is() && xLinkSupport->isLink() )
 -            {
 -                OUString aLinkURL = xLinkSupport->getLinkURL();
 +            bool bIFrame = false;
 -                if ( !aLinkURL.isEmpty() )
 +            OUString aLinkURL;
 +            uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
 +            if (xLinkSupport)
 +            {
 +                if (xLinkSupport->isLink())
 +                    aLinkURL = xLinkSupport->getLinkURL();
 +            }
 +            else
 +            {
 +                // get IFrame (Floating Frames) listed and updatable from the
 +                // manage links dialog
 +                SvGlobalName aClassId(xObject->getClassID());
 +                if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
                 {
 -                    // this is a file link so the model link manager should handle it
 -                    sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
 +                    uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
 +                    if (xSet.is())
 +                        xSet->getPropertyValue("FrameURL") >>= aLinkURL;
 +                    bIFrame = true;
 +                }
 +            }
 +
 +            if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
 +            {
 +                sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
 -                    if ( pLinkManager )
 +                if ( pLinkManager )
 +                {
 +                    SdrEmbedObjectLink* pEmbedObjectLink = nullptr;
 +                    if (!bIFrame)
                     {
 -                        mpImpl->mpObjectLink = new SdrEmbedObjectLink( this );
 -                        mpImpl->maLinkURL = aLinkURL;
 -                        pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
 -                        mpImpl->mpObjectLink->Connect();
 +                        pEmbedObjectLink = new SdrEmbedObjectLink(this);
 +                        mpImpl->mpObjectLink = pEmbedObjectLink;
                     }
 +                    else
 +                        mpImpl->mpObjectLink = new SdrIFrameLink(this);
 +                    mpImpl->maLinkURL = aLinkURL;
 +                    pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
 +                    if (pEmbedObjectLink)
 +                        pEmbedObjectLink->Connect();
                 }
             }
         }
@@ -955,7 +1012,7 @@ void SdrOle2Obj::CheckFileLink_Impl()
     }
 }
 -void SdrOle2Obj::Connect_Impl()
 +void SdrOle2Obj::Connect_Impl(SvxOle2Shape* pCreator)
 {
     if(!mpImpl->aPersistName.isEmpty() )
     {
@@ -995,6 +1052,17 @@ void SdrOle2Obj::Connect_Impl()
                 }
             }
 +            if (pCreator)
 +            {
 +                OUString sFrameURL(pCreator->GetAndClearInitialFrameURL());
 +                if (!sFrameURL.isEmpty() && svt::EmbeddedObjectRef::TryRunningState(mpImpl->mxObjRef.GetObject()))
 +                {
 +                    uno::Reference<beans::XPropertySet> xSet(mpImpl->mxObjRef->getComponent(), uno::UNO_QUERY);
 +                    if (xSet.is())
 +                        xSet->setPropertyValue("FrameURL", uno::Any(sFrameURL));
 +                }
 +            }
 +
             if ( mpImpl->mxObjRef.is() )
             {
                 if ( !mpImpl->mxLightClient.is() )
@@ -1308,14 +1376,14 @@ SdrObjectUniquePtr SdrOle2Obj::getFullDragClone() const
     return createSdrGrafObjReplacement(false);
 }
 -void SdrOle2Obj::SetPersistName( const OUString& rPersistName )
 +void SdrOle2Obj::SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator )
 {
     DBG_ASSERT( mpImpl->aPersistName.isEmpty(), "Persist name changed!");
     mpImpl->aPersistName = rPersistName;
     mpImpl->mbLoadingOLEObjectFailed = false;
 -    Connect();
 +    Connect(pCreator);
     SetChanged();
 }
 diff --git a/svx/source/unodraw/shapeimpl.hxx b/svx/source/unodraw/shapeimpl.hxx
 index a1a4e69630206..4381094d380a3 100644
 --- a/svx/source/unodraw/shapeimpl.hxx
 +++ b/svx/source/unodraw/shapeimpl.hxx
@@ -64,8 +64,11 @@ public:
     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
 };
 +
 class SvxFrameShape : public SvxOle2Shape
 {
 +private:
 +    OUString m_sInitialFrameURL;
 protected:
     // override these for special property handling in subcasses. Return true if property is handled
     virtual bool setPropertyValueImpl( const OUString& rName, const SfxItemPropertySimpleEntry* pProperty, const css::uno::Any& rValue ) override;
@@ -82,6 +85,8 @@ public:
     virtual void SAL_CALL setPropertyValues( const css::uno::Sequence< OUString >& aPropertyNames, const css::uno::Sequence< css::uno::Any >& aValues ) override;
     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
 +
 +    virtual OUString GetAndClearInitialFrameURL() override;
 };
 diff --git a/svx/source/unodraw/unoshap4.cxx b/svx/source/unodraw/unoshap4.cxx
 index f7629f3388587..6dc18d6cf9e48 100644
 --- a/svx/source/unodraw/unoshap4.cxx
 +++ b/svx/source/unodraw/unoshap4.cxx
@@ -180,7 +180,7 @@ bool SvxOle2Shape::setPropertyValueImpl( const OUString& rName, const SfxItemPro
 #else
             pOle = static_cast<SdrOle2Obj*>(GetSdrObject());
 #endif
 -            pOle->SetPersistName( aPersistName );
 +            pOle->SetPersistName( aPersistName, this );
             return true;
         }
         break;
@@ -501,10 +501,11 @@ void SvxOle2Shape::createLink( const OUString& aLinkURL )
 void SvxOle2Shape::resetModifiedState()
 {
 -    ::comphelper::IEmbeddedHelper* pPersist = GetSdrObject()->getSdrModelFromSdrObject().GetPersist();
 +    SdrObject* pObject = GetSdrObject();
 +    ::comphelper::IEmbeddedHelper* pPersist = pObject ? pObject->getSdrModelFromSdrObject().GetPersist() : nullptr;
     if( pPersist && !pPersist->isEnableSetModified() )
     {
 -        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >( GetSdrObject() );
 +        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >(pObject);
         if( pOle && !pOle->IsEmpty() )
         {
             uno::Reference < util::XModifiable > xMod( pOle->GetObjRef(), uno::UNO_QUERY );
@@ -554,6 +555,11 @@ SvGlobalName SvxOle2Shape::GetClassName_Impl(OUString& rHexCLSID)
     return aClassName;
 }
 +OUString SvxOle2Shape::GetAndClearInitialFrameURL()
 +{
 +    return OUString();
 +}
 +
 SvxAppletShape::SvxAppletShape(SdrObject* pObject)
     : SvxOle2Shape( pObject, getSvxMapProvider().GetMap(SVXMAP_APPLET), getSvxMapProvider().GetPropertySet(SVXMAP_APPLET, SdrObject::GetGlobalDrawObjectItemPool())  )
 {
@@ -707,8 +713,19 @@ SvxFrameShape::~SvxFrameShape() throw()
 {
 }
 +OUString SvxFrameShape::GetAndClearInitialFrameURL()
 +{
 +    OUString sRet(m_sInitialFrameURL);
 +    m_sInitialFrameURL.clear();
 +    return sRet;
 +}
 +
 void SvxFrameShape::Create( SdrObject* pNewObj, SvxDrawPage* pNewPage )
 {
 +    uno::Reference<beans::XPropertySet> xSet(static_cast<OWeakObject *>(this), uno::UNO_QUERY);
 +    if (xSet)
 +        xSet->getPropertyValue("FrameURL") >>= m_sInitialFrameURL;
 +
     SvxShape::Create( pNewObj, pNewPage );
     const SvGlobalName aIFrameClassId( SO3_IFRAME_CLASSID );
     createObject(aIFrameClassId);
 diff --git a/sw/inc/ndole.hxx b/sw/inc/ndole.hxx
 index 852fffd84e3d7..a2d9749420970 100644
 --- a/sw/inc/ndole.hxx
 +++ b/sw/inc/ndole.hxx
@@ -28,7 +28,7 @@ class SwGrfFormatColl;
 class SwDoc;
 class SwOLENode;
 class SwOLEListener_Impl;
 -class SwEmbedObjectLink;
 +namespace sfx2 { class SvBaseLink; }
 class DeflateData;
 class SW_DLLPUBLIC SwOLEObj
@@ -90,7 +90,7 @@ class SW_DLLPUBLIC SwOLENode: public SwNoTextNode
     bool   mbOLESizeInvalid; /**< Should be considered at SwDoc::PrtOLENotify
                                    (e.g. copied). Is not persistent. */
 -    SwEmbedObjectLink*  mpObjectLink;
 +    sfx2::SvBaseLink*  mpObjectLink;
     OUString maLinkURL;
     SwOLENode(  const SwNodeIndex &rWhere,
 diff --git a/sw/source/core/ole/ndole.cxx b/sw/source/core/ole/ndole.cxx
 index 9000d6ef1b9ee..7501fcdd09d7a 100644
 --- a/sw/source/core/ole/ndole.cxx
 +++ b/sw/source/core/ole/ndole.cxx
@@ -147,6 +147,8 @@ void SAL_CALL SwOLEListener_Impl::disposing( const lang::EventObject& )
 // TODO/LATER: actually SwEmbedObjectLink should be used here, but because different objects are used to control
 //             embedded object different link objects with the same functionality had to be implemented
 +namespace {
 +
 class SwEmbedObjectLink : public sfx2::SvBaseLink
 {
     SwOLENode*          pOleNode;
@@ -209,6 +211,44 @@ void SwEmbedObjectLink::Closed()
     SvBaseLink::Closed();
 }
 +class SwIFrameLink : public sfx2::SvBaseLink
 +{
 +    SwOLENode* m_pOleNode;
 +
 +public:
 +    explicit SwIFrameLink(SwOLENode* pNode)
 +        : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
 +        , m_pOleNode(pNode)
 +    {
 +        SetSynchron( false );
 +    }
 +
 +    ::sfx2::SvBaseLink::UpdateResult DataChanged(
 +        const OUString&, const uno::Any& )
 +    {
 +        uno::Reference<embed::XEmbeddedObject> xObject = m_pOleNode->GetOLEObj().GetOleRef();
 +        uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
 +        if (xPersObj.is())
 +        {
 +            // let the IFrameObject reload the link
 +            try
 +            {
 +                xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
 +            }
 +            catch (const uno::Exception&)
 +            {
 +            }
 +
 +            m_pOleNode->SetChanged();
 +        }
 +
 +        return SUCCESS;
 +    }
 +
 +};
 +
 +}
 +
 SwOLENode::SwOLENode( const SwNodeIndex &rWhere,
                     const svt::EmbeddedObjectRef& xObj,
                     SwGrfFormatColl *pGrfColl,
@@ -606,18 +646,49 @@ void SwOLENode::CheckFileLink_Impl()
     {
         try
         {
 -            uno::Reference< embed::XLinkageSupport > xLinkSupport( maOLEObj.m_xOLERef.GetObject(), uno::UNO_QUERY_THROW );
 -            if ( xLinkSupport->isLink() )
 +            uno::Reference<embed::XEmbeddedObject> xObject = maOLEObj.m_xOLERef.GetObject();
 +            if (!xObject)
 +                return;
 +
 +            bool bIFrame = false;
 +
 +            OUString aLinkURL;
 +            uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
 +            if (xLinkSupport)
 +            {
 +                if (xLinkSupport->isLink())
 +                    aLinkURL = xLinkSupport->getLinkURL();
 +            }
 +            else
             {
 -                const OUString aLinkURL = xLinkSupport->getLinkURL();
 -                if ( !aLinkURL.isEmpty() )
 +                // get IFrame (Floating Frames) listed and updatable from the
 +                // manage links dialog
 +                SvGlobalName aClassId(xObject->getClassID());
 +                if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
 +                {
 +                    uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
 +                    if (xSet.is())
 +                        xSet->getPropertyValue("FrameURL") >>= aLinkURL;
 +                    bIFrame = true;
 +                }
 +            }
 +
 +            if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
 +            {
 +                SwEmbedObjectLink* pEmbedObjectLink = nullptr;
 +                if (!bIFrame)
 +                {
 +                    pEmbedObjectLink = new SwEmbedObjectLink(this);
 +                    mpObjectLink = pEmbedObjectLink;
 +                }
 +                else
                 {
 -                    // this is a file link so the model link manager should handle it
 -                    mpObjectLink = new SwEmbedObjectLink( this );
 -                    maLinkURL = aLinkURL;
 -                    GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
 -                    mpObjectLink->Connect();
 +                    mpObjectLink = new SwIFrameLink(this);
                 }
 +                maLinkURL = aLinkURL;
 +                GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
 +                if (pEmbedObjectLink)
 +                    pEmbedObjectLink->Connect();
             }
         }
         catch( uno::Exception& )
 diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
 index ae35f1e21a87b..bd5f30af7d708 100644
 --- a/xmloff/source/draw/ximpshap.cxx
 +++ b/xmloff/source/draw/ximpshap.cxx
@@ -3223,9 +3223,35 @@ SdXMLFloatingFrameShapeContext::~SdXMLFloatingFrameShapeContext()
 {
 }
 +uno::Reference<drawing::XShape> SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape() const
 +{
 +    uno::Reference<lang::XMultiServiceFactory> xServiceFact(GetImport().GetModel(), uno::UNO_QUERY);
 +    if (!xServiceFact.is())
 +        return nullptr;
 +    uno::Reference<drawing::XShape> xShape(
 +            xServiceFact->createInstance("com.sun.star.drawing.FrameShape"), uno::UNO_QUERY);
 +    return xShape;
 +}
 +
 void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< css::xml::sax::XAttributeList >& )
 {
 -    AddShape("com.sun.star.drawing.FrameShape");
 +    uno::Reference<drawing::XShape> xShape(SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape());
 +
 +    uno::Reference< beans::XPropertySet > xProps(xShape, uno::UNO_QUERY);
 +    // set FrameURL before AddShape, we have to do it again later because it
 +    // gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
 +    // FrameURL to exist when AddShape triggers SetPersistName which itself
 +    // triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
 +    // know what URL will end up being used. So bodge this by setting FrameURL
 +    // to the temp pre-SdrOle2Obj attached properties and we can smuggle it
 +    // eventually into SdrOle2Obj::SetPersistName at the right point after
 +    // PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
 +    // in order to inform the link manager that this is an IFrame that links to
 +    // a URL
 +    if (xProps && !maHref.isEmpty())
 +        xProps->setPropertyValue("FrameURL", Any(maHref));
 +
 +    AddShape(xShape);
     if( mxShape.is() )
     {
@@ -3234,7 +3260,6 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
         // set pos, size, shear and rotate
         SetTransformation();
 -        uno::Reference< beans::XPropertySet > xProps( mxShape, uno::UNO_QUERY );
         if( xProps.is() )
         {
             if( !maFrameName.isEmpty() )
 diff --git a/xmloff/source/draw/ximpshap.hxx b/xmloff/source/draw/ximpshap.hxx
 index fae45f88f00a9..a00c87e8a0dab 100644
 --- a/xmloff/source/draw/ximpshap.hxx
 +++ b/xmloff/source/draw/ximpshap.hxx
@@ -513,6 +513,8 @@ private:
     OUString maFrameName;
     OUString maHref;
 +    css::uno::Reference<css::drawing::XShape> CreateFloatingFrameShape() const;
 +
 public:
     SdXMLFloatingFrameShapeContext( SvXMLImport& rImport, sal_uInt16 nPrfx,
 -- 
 2.41.0
--- a/SOURCES/0002-resource-leak.patch
+++ b/SOURCES/0002-resource-leak.patch
@ -0,0 +1,25 @@
 From abaf73f99c300ffe6c38dc7d1ce93ab09043f88a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 4 Nov 2020 11:02:21 +0000
 Subject: [PATCH 2/8] resource leak
 Change-Id: I1abd8acef55d5bdb4744ecf1a62d8e1396de0e3f
 ---
 vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx b/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
 index 52f0a34cd3a2..483283cadab5 100644
 --- a/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
 +++ b/vcl/unx/gtk3/a11y/gtk3atktextattributes.cxx
@@ -987,6 +987,7 @@ TabStopList2String( const uno::Any& rAny, bool default_tabs )
             {
                 gchar * old_tab_str = ret;
                 ret = g_strconcat(old_tab_str, " ", tab_str, nullptr);
 +                g_free( tab_str );
                 g_free( old_tab_str );
             }
             else
 -- 
 2.28.0
--- a/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
+++ b/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
@ -0,0 +1,50 @@
 From 7e128f02a7cb513e4e57dbb1970fa316f456aa45 Mon Sep 17 00:00:00 2001
 From: Eike Rathke <erack@redhat.com>
 Date: Mon, 27 Feb 2023 16:10:06 +0100
 Subject: [PATCH 3/3] Always push a result, even if it's only an error
 PERCENTILE() and QUARTILE() if an error was passed as argument (or
 an error encountered during obtaining arguments) omitted to push
 an error result, only setting the error.
 Fallout from
    commit f336f63da900d76c2bf6e5690f1c8a7bd15a0aa2
    CommitDate: Thu Mar 3 16:28:59 2016 +0000
        tdf#94635 Add FORECAST.ETS functions to Calc
 Change-Id: I23e276fb0ce735cfd6383cc963446499dcf819f4
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147922
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Tested-by: Jenkins
 (cherry picked from commit 64914560e279c71ff1233f4bab851e2a292797e6)
 ---
 sc/source/core/tool/interpr3.cxx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/sc/source/core/tool/interpr3.cxx b/sc/source/core/tool/interpr3.cxx
 index f219beca9386..d442d4eee224 100644
 --- a/sc/source/core/tool/interpr3.cxx
 +++ b/sc/source/core/tool/interpr3.cxx
@@ -3474,7 +3474,7 @@ void ScInterpreter::ScPercentile( bool bInclusive )
     GetNumberSequenceArray( 1, aArray, false );
     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
     {
 -        SetError( FormulaError::NoValue );
 +        PushNoValue();
         return;
     }
     if ( bInclusive )
@@ -3497,7 +3497,7 @@ void ScInterpreter::ScQuartile( bool bInclusive )
     GetNumberSequenceArray( 1, aArray, false );
     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
     {
 -        SetError( FormulaError::NoValue );
 +        PushNoValue();
         return;
     }
     if ( bInclusive )
 -- 
 2.41.0
--- a/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
+++ b/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
@ -0,0 +1,586 @@
 From a3046cfa58bdfa2a1b9ea6287a021230830f056f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 22 Mar 2022 17:22:22 +0000
 Subject: [PATCH] add Initialization Vectors to password storage
 old ones default to the current all zero case and continue to work
 as before
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131974
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit 192fa1e3bfc6269f2ebb91716471485a56074aea)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132306
 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
 (cherry picked from commit ab77587ec300f5c30084471000663c46ddf25dad)
 Change-Id: I6fe3b02fafcce1b5e7133e77e76a5118177d77af
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133907
 Tested-by: Michael Stahl <michael.stahl@allotropia.de>
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 ---
 .../schema/org/openoffice/Office/Common.xcs   |  10 ++
 .../passwordcontainer/passwordcontainer.cxx   | 127 ++++++++++++------
 .../passwordcontainer/passwordcontainer.hxx   |  63 +++++++--
 3 files changed, 151 insertions(+), 49 deletions(-)
 diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 index b033b29b60d7..e57d26ab3366 100644
 --- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
 +++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
@@ -27,6 +27,11 @@
       <info>
         <desc>Contains a container for passwords.</desc>
       </info>
 +      <prop oor:name="InitializationVector" oor:type="xs:string">
 +        <info>
 +          <desc>Contains an initialization vector for the password encryption.</desc>
 +        </info>
 +      </prop>
       <prop oor:name="Password" oor:type="xs:string" oor:localized="false">
         <info>
           <desc>Contains a password encoded with the master password.</desc>
@@ -923,6 +928,11 @@
         </info>
         <value>false</value>
       </prop>
 +      <prop oor:name="MasterInitializationVector" oor:type="xs:string">
 +        <info>
 +          <desc>Contains an initialization vector for the master password encryption.</desc>
 +        </info>
 +      </prop>
       <prop oor:name="Master" oor:type="xs:string" oor:nillable="false">
         <info>
           <desc>Contains the master password encrypted by itself.</desc>
 diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
 index ff0b40df4016..380188ef495c 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.cxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.cxx
@@ -184,15 +184,18 @@ PassMap StorageItem::getInfo()
     Sequence< OUString > aNodeNames     = ConfigItem::GetNodeNames( "Store" );
     sal_Int32 aNodeCount = aNodeNames.getLength();
 -    Sequence< OUString > aPropNames( aNodeCount );
 +    Sequence< OUString > aPropNames( aNodeCount * 2);
     std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.begin(),
         [](const OUString& rName) -> OUString {
             return "Store/Passwordstorage['" + rName + "']/Password"; });
 +    std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.getArray() + aNodeCount,
 +        [](const OUString& rName) -> OUString {
 +            return "Store/Passwordstorage['" + rName + "']/InitializationVector"; });
     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aPropNames );
 -    if( aPropertyValues.getLength() != aNodeCount )
 +    if( aPropertyValues.getLength() != aNodeCount * 2)
     {
         OSL_FAIL( "Problems during reading" );
         return aResult;
@@ -208,14 +211,16 @@ PassMap StorageItem::getInfo()
             OUString aName = aUrlUsr[1];
             OUString aEPasswd;
 +            OUString aIV;
             aPropertyValues[aNodeInd] >>= aEPasswd;
 +            aPropertyValues[aNodeInd + aNodeCount] >>= aIV;
             PassMap::iterator aIter = aResult.find( aUrl );
             if( aIter != aResult.end() )
 -                aIter->second.emplace_back( aName, aEPasswd );
 +                aIter->second.emplace_back( aName, aEPasswd, aIV );
             else
             {
 -                NamePassRecord aNewRecord( aName, aEPasswd );
 +                NamePassRecord aNewRecord( aName, aEPasswd, aIV );
                 std::vector< NamePassRecord > listToAdd( 1, aNewRecord );
                 aResult.insert( PairUrlRecord( aUrl, listToAdd ) );
@@ -279,17 +284,19 @@ sal_Int32 StorageItem::getStorageVersion()
     return nResult;
 }
 -bool StorageItem::getEncodedMP( OUString& aResult )
 +bool StorageItem::getEncodedMP( OUString& aResult, OUString& aResultIV )
 {
     if( hasEncoded )
     {
         aResult = mEncoded;
 +        aResultIV = mEncodedIV;
         return true;
     }
 -    Sequence< OUString > aNodeNames( 2 );
 +    Sequence< OUString > aNodeNames( 3 );
     aNodeNames[0] = "HasMaster";
     aNodeNames[1] = "Master";
 +    aNodeNames[2] = "MasterInitializationVector";
     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
@@ -301,32 +308,37 @@ bool StorageItem::getEncodedMP( OUString& aResult )
     aPropertyValues[0] >>= hasEncoded;
     aPropertyValues[1] >>= mEncoded;
 +    aPropertyValues[2] >>= mEncodedIV;
     aResult = mEncoded;
 +    aResultIV = mEncodedIV;
     return hasEncoded;
 }
 -void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
 +void StorageItem::setEncodedMP( const OUString& aEncoded, const OUString& aEncodedIV, bool bAcceptEmpty )
 {
 -    Sequence< OUString > sendNames(3);
 -    Sequence< uno::Any > sendVals(3);
 +    Sequence< OUString > sendNames(4);
 +    Sequence< uno::Any > sendVals(4);
     sendNames[0] = "HasMaster";
     sendNames[1] = "Master";
 -    sendNames[2] = "StorageVersion";
 +    sendNames[2] = "MasterInitializationVector";
 +    sendNames[3] = "StorageVersion";
     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
     sendVals[0] <<= bHasMaster;
     sendVals[1] <<= aEncoded;
 -    sendVals[2] <<= nCurrentStorageVersion;
 +    sendVals[2] <<= aEncodedIV;
 +    sendVals[3] <<= nCurrentStorageVersion;
     ConfigItem::SetModified();
     ConfigItem::PutProperties( sendNames, sendVals );
     hasEncoded = bHasMaster;
     mEncoded = aEncoded;
 +    mEncodedIV = aEncodedIV;
 }
@@ -362,11 +374,13 @@ void StorageItem::update( const OUString& aURL, const NamePassRecord& aRecord )
     forIndex.push_back( aURL );
     forIndex.push_back( aRecord.GetUserName() );
 -    Sequence< beans::PropertyValue > sendSeq(1);
 +    Sequence< beans::PropertyValue > sendSeq(2);
 -    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
 +    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( { aURL, aRecord.GetUserName() } ) + "']/InitializationVector";
 +    sendSeq[0].Value <<= aRecord.GetPersistentIV();
 -    sendSeq[0].Value <<= aRecord.GetPersPasswords();
 +    sendSeq[1].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
 +    sendSeq[1].Value <<= aRecord.GetPersPasswords();
     ConfigItem::SetModified();
     ConfigItem::SetSetProperties( "Store", sendSeq );
@@ -427,7 +441,7 @@ void SAL_CALL PasswordContainer::disposing( const EventObject& )
     }
 }
 -std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
 +std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
 {
     if( !aMasterPasswd.isEmpty() )
     {
@@ -442,9 +456,16 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
 +            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
 +            if (!aIV.isEmpty())
 +            {
 +                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
 +                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
 +            }
 +
             rtlCipherError result = rtl_cipher_init (
                     aDecoder, rtl_Cipher_DirectionDecode,
 -                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
 +                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
             if( result == rtl_Cipher_E_None )
             {
@@ -477,7 +498,7 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
         "Can't decode!", css::uno::Reference<css::uno::XInterface>(), mode);
 }
 -OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPasswd )
 +OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPasswd)
 {
     if( !aMasterPasswd.isEmpty() )
     {
@@ -494,9 +515,16 @@ OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines
             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
 +            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
 +            if (!aIV.isEmpty())
 +            {
 +                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
 +                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
 +            }
 +
             rtlCipherError result = rtl_cipher_init (
                     aEncoder, rtl_Cipher_DirectionEncode,
 -                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
 +                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
             if( result == rtl_Cipher_E_None )
             {
@@ -564,7 +592,7 @@ void PasswordContainer::UpdateVector( const OUString& aURL, std::vector< NamePas
             if( aRecord.HasPasswords( PERSISTENT_RECORD ) )
             {
 -                aNPIter.SetPersPasswords( aRecord.GetPersPasswords() );
 +                aNPIter.SetPersPasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV() );
                 if( writeFile )
                 {
@@ -597,7 +625,8 @@ UserRecord PasswordContainer::CopyToUserRecord( const NamePassRecord& aRecord, b
     {
         try
         {
 -            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
 +            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV(),
 +                                                                           GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
             aPasswords.insert( aPasswords.end(), aDecodedPasswords.begin(), aDecodedPasswords.end() );
         }
         catch( NoMasterException& )
@@ -642,6 +671,19 @@ void SAL_CALL PasswordContainer::addPersistent( const OUString& Url, const OUStr
     PrivateAdd( Url, UserName, Passwords, PERSISTENT_RECORD, aHandler );
 }
 +OUString PasswordContainer::createIV()
 +{
 +    rtlRandomPool randomPool = mRandomPool.get();
 +    unsigned char iv[RTL_DIGEST_LENGTH_MD5];
 +    rtl_random_getBytes(randomPool, iv, RTL_DIGEST_LENGTH_MD5);
 +    OUStringBuffer aBuffer;
 +    for (sal_uInt8 i : iv)
 +    {
 +        aBuffer.append(OUString::number(i >> 4, 16));
 +        aBuffer.append(OUString::number(i & 15, 16));
 +    }
 +    return aBuffer.makeStringAndClear();
 +}
 void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserName, const Sequence< OUString >& Passwords, char Mode, const Reference< XInteractionHandler >& aHandler )
 {
@@ -649,7 +691,11 @@ void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserNam
     ::std::vector< OUString > aStorePass = comphelper::sequenceToContainer< std::vector<OUString> >( Passwords );
     if( Mode == PERSISTENT_RECORD )
 -        aRecord.SetPersPasswords( EncodePasswords( aStorePass, GetMasterPassword( aHandler ) ) );
 +    {
 +        OUString sIV = createIV();
 +        OUString sEncodedPasswords = EncodePasswords( aStorePass, sIV, GetMasterPassword( aHandler ) );
 +        aRecord.SetPersPasswords( sEncodedPasswords, sIV );
 +    }
     else if( Mode == MEMORY_RECORD )
         aRecord.SetMemPasswords( aStorePass );
     else
@@ -842,10 +888,10 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
     if( m_aMasterPasswd.isEmpty() && aHandler.is() )
     {
 -        OUString aEncodedMP;
 +        OUString aEncodedMP, aEncodedMPIV;
         bool bDefaultPassword = false;
 -        if( !m_pStorageFile->getEncodedMP( aEncodedMP ) )
 +        if( !m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
             aRMode = PasswordRequestMode_PASSWORD_CREATE;
         else if ( aEncodedMP.isEmpty() )
         {
@@ -867,14 +913,15 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
                         m_aMasterPasswd = aPass;
                         std::vector< OUString > aMaster( 1, m_aMasterPasswd );
 -                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
 +                        OUString sIV = createIV();
 +                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, sIV, m_aMasterPasswd ), sIV );
                     }
                     else
                     {
                         if (m_pStorageFile->getStorageVersion() == 0)
                             aPass = ReencodeAsOldHash(aPass);
 -                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
 +                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aEncodedMPIV, aPass, aRMode ) );
                         if( aRM.empty() || aPass != aRM[0] )
                         {
                             bAskAgain = true;
@@ -1031,7 +1078,8 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
             {
                 sal_Int32 oldLen = aUsers.getLength();
                 aUsers.realloc( oldLen + 1 );
 -                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
 +                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), aNP.GetPersistentIV(),
 +                                                                                                                    GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
             }
         if( aUsers.hasElements() )
@@ -1048,12 +1096,12 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
 sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::Reference< task::XInteractionHandler >& xHandler )
 {
     bool bResult = false;
 -    OUString aEncodedMP;
 +    OUString aEncodedMP, aEncodedMPIV;
     uno::Reference< task::XInteractionHandler > xTmpHandler = xHandler;
     ::osl::MutexGuard aGuard( mMutex );
     // the method should fail if there is no master password
 -    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) )
 +    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
     {
         if ( aEncodedMP.isEmpty() )
         {
@@ -1122,8 +1170,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
         bool bCanChangePassword = true;
         // if there is already a stored master password it should be entered by the user before the change happen
 -        OUString aEncodedMP;
 -        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP ) )
 +        OUString aEncodedMP, aEncodedMPIV;
 +        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
         if ( bCanChangePassword )
@@ -1142,7 +1190,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
                 // store the new master password
                 m_aMasterPasswd = aPass;
                 std::vector< OUString > aMaster( 1, m_aMasterPasswd );
 -                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
 +                OUString aIV = createIV();
 +                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, aIV, m_aMasterPasswd ), aIV );
                 // store all the entries with the new password
                 for ( const auto& rURL : aPersistent )
@@ -1167,7 +1216,7 @@ void SAL_CALL PasswordContainer::removeMasterPassword()
     if ( m_pStorageFile )
     {
         m_aMasterPasswd.clear();
 -        m_pStorageFile->setEncodedMP( OUString() ); // let the master password be removed from configuration
 +        m_pStorageFile->setEncodedMP( OUString(), OUString() ); // let the master password be removed from configuration
     }
 }
@@ -1178,8 +1227,8 @@ sal_Bool SAL_CALL PasswordContainer::hasMasterPassword(  )
     if ( !m_pStorageFile )
         throw uno::RuntimeException();
 -    OUString aEncodedMP;
 -    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) );
 +    OUString aEncodedMP, aEncodedMPIV;
 +    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) );
 }
 sal_Bool SAL_CALL PasswordContainer::allowPersistentStoring( sal_Bool bAllow )
@@ -1226,8 +1275,8 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
         bool bCanChangePassword = true;
         // if there is already a stored nondefault master password it should be entered by the user before the change happen
 -        OUString aEncodedMP;
 -        if( m_pStorageFile->getEncodedMP( aEncodedMP ) && !aEncodedMP.isEmpty() )
 +        OUString aEncodedMP, aEncodedMPIV;
 +        if( m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && !aEncodedMP.isEmpty() )
             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
         if ( bCanChangePassword )
@@ -1244,7 +1293,7 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
                 // store the empty string to flag the default master password
                 m_aMasterPasswd = aPass;
 -                m_pStorageFile->setEncodedMP( OUString(), true );
 +                m_pStorageFile->setEncodedMP( OUString(), OUString(), true );
                 // store all the entries with the new password
                 for ( const auto& rURL : aPersistent )
@@ -1268,8 +1317,8 @@ sal_Bool SAL_CALL PasswordContainer::isDefaultMasterPasswordUsed()
     if ( !m_pStorageFile )
         throw uno::RuntimeException();
 -    OUString aEncodedMP;
 -    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) && aEncodedMP.isEmpty() );
 +    OUString aEncodedMP, aEncodedMPIV;
 +    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && aEncodedMP.isEmpty() );
 }
 diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
 index cf5c717d0c9e..4e3a6629139e 100644
 --- a/svl/source/passwordcontainer/passwordcontainer.hxx
 +++ b/svl/source/passwordcontainer/passwordcontainer.hxx
@@ -33,6 +33,7 @@
 #include <unotools/configitem.hxx>
 #include <ucbhelper/interactionrequest.hxx>
 +#include <rtl/random.h>
 #include <rtl/ref.hxx>
 #include <osl/mutex.hxx>
@@ -51,11 +52,12 @@ class NamePassRecord
     ::std::vector< OUString >                      m_aMemPass;
     // persistent passwords are encrypted in one string
 -    bool                                                  m_bHasPersPass;
 +    bool                                           m_bHasPersPass;
     OUString                                       m_aPersPass;
 +    OUString                                       m_aPersistentIV;
     void InitArrays( bool bHasMemoryList, const ::std::vector< OUString >& aMemoryList,
 -                     bool bHasPersistentList, const OUString& aPersistentList )
 +                     bool bHasPersistentList, const OUString& aPersistentList, const OUString& aPersistentIV )
     {
         m_bHasMemPass = bHasMemoryList;
         if ( bHasMemoryList )
@@ -63,7 +65,10 @@ class NamePassRecord
         m_bHasPersPass = bHasPersistentList;
         if ( bHasPersistentList )
 +        {
             m_aPersPass = aPersistentList;
 +            m_aPersistentIV = aPersistentIV;
 +        }
     }
 public:
@@ -75,11 +80,12 @@ public:
     {
     }
 -    NamePassRecord( const OUString& aName, const OUString& aPersistentList )
 +    NamePassRecord( const OUString& aName, const OUString& aPersistentList, const OUString& aPersistentIV )
         : m_aName( aName )
         , m_bHasMemPass( false )
         , m_bHasPersPass( true )
         , m_aPersPass( aPersistentList )
 +        , m_aPersistentIV( aPersistentIV )
     {
     }
@@ -88,7 +94,8 @@ public:
         , m_bHasMemPass( false )
         , m_bHasPersPass( false )
     {
 -        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
 +        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
 +                    aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
     }
     NamePassRecord& operator=( const NamePassRecord& aRecord )
@@ -99,7 +106,9 @@ public:
             m_aMemPass.clear();
             m_aPersPass.clear();
 -            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
 +            m_aPersistentIV.clear();
 +            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
 +                        aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
         }
         return *this;
     }
@@ -135,15 +144,24 @@ public:
         return OUString();
     }
 +    OUString GetPersistentIV() const
 +    {
 +        if ( m_bHasPersPass )
 +            return m_aPersistentIV;
 +
 +        return OUString();
 +    }
 +
     void SetMemPasswords( const ::std::vector< OUString >& aMemList )
     {
         m_aMemPass = aMemList;
         m_bHasMemPass = true;
     }
 -    void SetPersPasswords( const OUString& aPersList )
 +    void SetPersPasswords( const OUString& aPersList, const OUString& aPersIV )
     {
         m_aPersPass = aPersList;
 +        m_aPersistentIV = aPersIV;
         m_bHasPersPass = true;
     }
@@ -158,6 +176,7 @@ public:
         {
             m_bHasPersPass = false;
             m_aPersPass.clear();
 +            m_aPersistentIV.clear();
         }
     }
@@ -181,6 +200,7 @@ private:
     PasswordContainer*     mainCont;
     bool                   hasEncoded;
     OUString        mEncoded;
 +    OUString        mEncodedIV;
     virtual void            ImplCommit() override;
@@ -201,8 +221,8 @@ public:
     sal_Int32 getStorageVersion();
 -    bool getEncodedMP( OUString& aResult );
 -    void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
 +    bool getEncodedMP( OUString& aResult, OUString& aResultIV );
 +    void setEncodedMP( const OUString& aResult, const OUString& aResultIV, bool bAcceptEmpty = false );
     void setUseStorage( bool bUse );
     bool useStorage();
@@ -223,6 +243,29 @@ private:
     css::uno::Reference< css::lang::XComponent > mComponent;
     SysCredentialsConfig mUrlContainer;
 +    class RandomPool
 +    {
 +    private:
 +        rtlRandomPool m_aRandomPool;
 +    public:
 +        RandomPool() : m_aRandomPool(rtl_random_createPool())
 +        {
 +        }
 +        rtlRandomPool get()
 +        {
 +            return m_aRandomPool;
 +        }
 +        ~RandomPool()
 +        {
 +            // Clean up random pool memory
 +            rtl_random_destroyPool(m_aRandomPool);
 +        }
 +    };
 +
 +    RandomPool mRandomPool;
 +
 +    OUString createIV();
 +
     /// @throws css::uno::RuntimeException
     css::uno::Sequence< css::task::UserRecord > CopyToUserRecordSequence(
                                         const ::std::vector< NamePassRecord >& original,
@@ -273,10 +316,10 @@ css::task::UrlRecord find(
                               const css::uno::Reference< css::task::XInteractionHandler >& Handler );
     /// @throws css::uno::RuntimeException
 -    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
 +    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
     /// @throws css::uno::RuntimeException
 -    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPassword );
 +    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPassword );
 public:
     PasswordContainer( const css::uno::Reference< css::lang::XMultiServiceFactory >& );
 -- 
 2.37.1
--- a/SOURCES/0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot.patch
+++ b/SOURCES/0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot.patch
@ -0,0 +1,225 @@
 From ae89e7b8ae1e781c1a9d8ca2c5d4aeca656932f8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Fri, 3 Nov 2023 17:26:25 +0000
 Subject: [PATCH] default to ignoring libreoffice special-purpose protocols in
 calc hyperlink
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
 Tested-by: Jenkins
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159045
 Reviewed-by: Eike Rathke <erack@redhat.com>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159882
 Tested-by: Miklos Vajna <vmiklos@collabora.com>
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159912
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 erAck: backported to 6.4.7.2
 ---
 dbaccess/source/core/dataaccess/ModelImpl.cxx |  3 +-
 include/sfx2/docmacromode.hxx                 |  5 ++-
 include/sfx2/objsh.hxx                        |  3 ++
 sc/source/core/data/global.cxx                | 33 ++++++++++++++++++-
 sfx2/source/doc/docmacromode.cxx              |  8 +++--
 sfx2/source/doc/objmisc.cxx                   |  8 ++++-
 sfx2/source/doc/objxtor.cxx                   |  1 +
 sfx2/source/inc/objshimp.hxx                  |  3 +-
 8 files changed, 57 insertions(+), 7 deletions(-)
 diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx b/dbaccess/source/core/dataaccess/ModelImpl.cxx
 index 1f11f36..ce4dbae 100644
 --- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
 +++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
@@ -1140,7 +1140,8 @@ bool ODatabaseModelImpl::checkMacrosOnLoading()
 {
     Reference< XInteractionHandler > xInteraction;
     xInteraction = m_aMediaDescriptor.getOrDefault( "InteractionHandler", xInteraction );
 -    return m_aMacroMode.checkMacrosOnLoading( xInteraction );
 +    const bool bHasMacros = m_aMacroMode.hasMacros();
 +    return m_aMacroMode.checkMacrosOnLoading(xInteraction, bHasMacros);
 }
 void ODatabaseModelImpl::resetMacroExecutionMode()
 diff --git a/include/sfx2/docmacromode.hxx b/include/sfx2/docmacromode.hxx
 index a15bbbe..98b7d3a 100644
 --- a/include/sfx2/docmacromode.hxx
 +++ b/include/sfx2/docmacromode.hxx
@@ -260,6 +260,8 @@ namespace sfx2
         */
         static bool storageHasMacros( const css::uno::Reference< css::embed::XStorage >& _rxStorage );
 +        bool hasMacros() const;
 +
         static bool containerHasBasicMacros( const css::uno::Reference< css::script::XLibraryContainer >& xContainter );
         /** checks the macro execution mode while loading the document.
@@ -286,7 +288,8 @@ namespace sfx2
         */
         bool
                 checkMacrosOnLoading(
 -                    const css::uno::Reference< css::task::XInteractionHandler >& _rxInteraction
 +                    const css::uno::Reference< css::task::XInteractionHandler >& _rxInteraction,
 +                    bool bHasMacros
                 );
     private:
 diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
 index 2a56ebe..43df460 100644
 --- a/include/sfx2/objsh.hxx
 +++ b/include/sfx2/objsh.hxx
@@ -418,6 +418,9 @@ public:
     void                        SetMacroCallsSeenWhileLoading();
     bool                        GetMacroCallsSeenWhileLoading() const;
 +    // true if the document had macros (or similar) on load to trigger warning user
 +    bool                        GetHadCheckedMacrosOnLoad() const;
 +
     const css::uno::Sequence< css::beans::PropertyValue >& GetModifyPasswordInfo() const;
     bool                        SetModifyPasswordInfo( const css::uno::Sequence< css::beans::PropertyValue >& aInfo );
 diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
 index 050fd82..92d50c4 100644
 --- a/sc/source/core/data/global.cxx
 +++ b/sc/source/core/data/global.cxx
@@ -26,7 +26,9 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/dispatch.hxx>
 #include <sfx2/objsh.hxx>
 +#include <sfx2/sfxresid.hxx>
 #include <sfx2/sfxsids.hrc>
 +#include <sfx2/strings.hrc>
 #include <sfx2/viewfrm.hxx>
 #include <sfx2/viewsh.hxx>
 #include <svl/intitem.hxx>
@@ -789,7 +791,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
     OUString aUrlName( rURL );
     SfxViewFrame* pFrame = nullptr;
 -    const SfxObjectShell* pObjShell = nullptr;
 +    SfxObjectShell* pObjShell = nullptr;
     OUString aReferName;
     if ( pScActiveViewShell )
     {
@@ -823,6 +825,35 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
             aUrlName = aNewUrlName;
     }
 +    if (INetURLObject(aUrlName).IsExoticProtocol())
 +    {
 +        // Default to ignoring exotic protocols
 +        bool bAllow = false;
 +        if (pObjShell)
 +        {
 +            // If the document had macros when loaded then follow the allowed macro-mode
 +            if (pObjShell->GetHadCheckedMacrosOnLoad())
 +                bAllow = pObjShell->AdjustMacroMode();
 +            else // otherwise ask the user, defaulting to cancel
 +            {
 +                assert(pFrame && "if we have pObjShell we have pFrame");
 +                //Reuse URITools::onOpenURI warning string
 +                std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pFrame->GetFrameWeld(),
 +                                                               VclMessageType::Warning, VclButtonsType::YesNo,
 +                                                               SfxResId(STR_DANGEROUS_TO_OPEN)));
 +                xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
 +                    INetURLObject::decode(aUrlName, INetURLObject::DecodeMechanism::Unambiguous)));
 +                xQueryBox->set_default_response(RET_NO);
 +                bAllow = xQueryBox->run() == RET_YES;
 +            }
 +        }
 +        if (!bAllow)
 +        {
 +            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
 +            return;
 +        }
 +    }
 +
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
     if ( nScClickMouseModifier & KEY_SHIFT )     // control-click -> into new window
 diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
 index 492bd0a..7f1fb2b 100644
 --- a/sfx2/source/doc/docmacromode.cxx
 +++ b/sfx2/source/doc/docmacromode.cxx
@@ -391,8 +391,12 @@ namespace sfx2
         return bHasMacros;
     }
 +    bool DocumentMacroMode::hasMacros() const
 +    {
 +        return m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading();
 +    }
 -    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction )
 +    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction, bool bHasMacros )
     {
         bool bAllow = false;
         if ( SvtSecurityOptions().IsMacroDisabled() )
@@ -402,7 +406,7 @@ namespace sfx2
         }
         else
         {
 -            if (m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
 +            if (bHasMacros)
             {
                 bAllow = adjustMacroMode( rxInteraction );
             }
 diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
 index 6819404..fac75dd 100644
 --- a/sfx2/source/doc/objmisc.cxx
 +++ b/sfx2/source/doc/objmisc.cxx
@@ -953,9 +953,15 @@ void SfxObjectShell::CheckSecurityOnLoading_Impl()
     CheckEncryption_Impl( xInteraction );
     // check macro security
 -    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction );
 +    const bool bHasMacros = pImpl->aMacroMode.hasMacros();
 +    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasMacros );
 +    pImpl->m_bHadCheckedMacrosOnLoad = bHasMacros;
 }
 +bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
 +{
 +    return pImpl->m_bHadCheckedMacrosOnLoad;
 +}
 void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
 {
 diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx
 index 510c35d..a707bb7 100644
 --- a/sfx2/source/doc/objxtor.cxx
 +++ b/sfx2/source/doc/objxtor.cxx
@@ -237,6 +237,7 @@ SfxObjectShell_Impl::SfxObjectShell_Impl( SfxObjectShell& _rDocShell )
     ,m_bAllowShareControlFileClean( true )
     ,m_bConfigOptionsChecked( false )
     ,m_bMacroCallsSeenWhileLoading( false )
 +    ,m_bHadCheckedMacrosOnLoad( false )
     ,lErr(ERRCODE_NONE)
     ,nEventId ( SfxEventHintId::NONE )
     ,nLoadedFlags ( SfxLoadedFlags::ALL )
 diff --git a/sfx2/source/inc/objshimp.hxx b/sfx2/source/inc/objshimp.hxx
 index 3d7b0b6..4afdd70 100644
 --- a/sfx2/source/inc/objshimp.hxx
 +++ b/sfx2/source/inc/objshimp.hxx
@@ -91,7 +91,8 @@ struct SfxObjectShell_Impl : public ::sfx2::IMacroDocumentAccess
                         m_bSharedXMLFlag:1, // whether the document should be edited in shared mode
                         m_bAllowShareControlFileClean:1, // whether the flag should be stored in xml file
                         m_bConfigOptionsChecked:1, // whether or not the user options are checked after the Options dialog is closed.
 -                        m_bMacroCallsSeenWhileLoading:1; // whether or not the user options are checked after the Options dialog is closed.
 +                        m_bMacroCallsSeenWhileLoading:1, // whether or not macro calls were seen when loading document.
 +                        m_bHadCheckedMacrosOnLoad:1; // if document contained macros (or calls) when loaded
     IndexBitSet         aBitSet;
     ErrCode             lErr;
 -- 
 2.43.0
--- a/SOURCES/0003-Related-rhbz-1618703-Properly-handle-failure-encodin.patch
+++ b/SOURCES/0003-Related-rhbz-1618703-Properly-handle-failure-encodin.patch
@ -1,284 +0,0 @@
 From 7d7089282e764d5c8481602fb2067c619882e45e Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Thu, 23 Aug 2018 18:10:01 +0200
 Subject: [PATCH 3/5] Related rhbz#1618703: Properly handle failure encoding MS
 file
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...when e.g. FIPS mode makes EncryptRC4 (in sw/source/filter/ww8/wrtww8.cxx)
 fail, but which hadn't been propagated out to SwWW8Writer::WriteStorage (in
 sw/source/filter/ww8/wrtww8.cxx)
 Reviewed-on: https://gerrit.libreoffice.org/59518
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 229340812f6e6cc8c868915055583f60c82a8cf3)
 Conflicts:
 	sw/source/filter/ww8/docxexport.cxx
 ...plus cherry-pick of follow-up 8114f976b897c4717368146a49d5404ef970c77a
 "coverity#1438527 Nesting level does not match indentation"
 Reviewed-on: https://gerrit.libreoffice.org/59572
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 5be8cbdb874621111cb157a98013e254de3b269c)
 Conflicts:
 	sw/source/filter/ww8/wrtww8.cxx
 Change-Id: I1123136ce1a25e181a0a27486954621a2dd095ea
 ---
 sw/source/filter/ww8/docxexport.cxx |  4 ++-
 sw/source/filter/ww8/docxexport.hxx |  2 +-
 sw/source/filter/ww8/rtfexport.cxx  |  4 ++-
 sw/source/filter/ww8/rtfexport.hxx  |  2 +-
 sw/source/filter/ww8/wrtww8.cxx     | 42 +++++++++++++++++++++--------
 sw/source/filter/ww8/wrtww8.hxx     |  6 ++---
 6 files changed, 42 insertions(+), 18 deletions(-)
 diff --git a/sw/source/filter/ww8/docxexport.cxx b/sw/source/filter/ww8/docxexport.cxx
 index 477422bee989..0b40a58df2bf 100644
 --- a/sw/source/filter/ww8/docxexport.cxx
 +++ b/sw/source/filter/ww8/docxexport.cxx
@@ -490,7 +490,7 @@ void DocxExport::OutputDML(uno::Reference<drawing::XShape> const & xShape)
     aExport.WriteShape(xShape);
 }
 -void DocxExport::ExportDocument_Impl()
 +ErrCode DocxExport::ExportDocument_Impl()
 {
     // Set the 'Track Revisions' flag in the settings structure
     m_aSettings.trackRevisions = bool( RedlineFlags::On & m_nOrigRedlineFlags );
@@ -530,6 +530,8 @@ void DocxExport::ExportDocument_Impl()
     m_pStyles = nullptr;
     delete m_pSections;
     m_pSections = nullptr;
 +
 +    return ERRCODE_NONE;
 }
 void DocxExport::AppendSection( const SwPageDesc *pPageDesc, const SwSectionFormat* pFormat, sal_uLong nLnNum )
 diff --git a/sw/source/filter/ww8/docxexport.hxx b/sw/source/filter/ww8/docxexport.hxx
 index b553ba3f2601..8b42290594ae 100644
 --- a/sw/source/filter/ww8/docxexport.hxx
 +++ b/sw/source/filter/ww8/docxexport.hxx
@@ -191,7 +191,7 @@ public:
 protected:
     /// Format-dependent part of the actual export.
 -    virtual void ExportDocument_Impl() override;
 +    virtual ErrCode ExportDocument_Impl() override;
     /// Output SwEndNode
     virtual void OutputEndNode( const SwEndNode& ) override;
 diff --git a/sw/source/filter/ww8/rtfexport.cxx b/sw/source/filter/ww8/rtfexport.cxx
 index 586dd01f23bd..679b96ac9a77 100644
 --- a/sw/source/filter/ww8/rtfexport.cxx
 +++ b/sw/source/filter/ww8/rtfexport.cxx
@@ -660,7 +660,7 @@ void RtfExport::WritePageDescTable()
     m_pTableInfo = std::make_shared<ww8::WW8TableInfo>();
 }
 -void RtfExport::ExportDocument_Impl()
 +ErrCode RtfExport::ExportDocument_Impl()
 {
     // Make the header
     Strm()
@@ -931,6 +931,8 @@ void RtfExport::ExportDocument_Impl()
     WriteMainText();
     Strm().WriteChar('}');
 +
 +    return ERRCODE_NONE;
 }
 void RtfExport::PrepareNewPageDesc(const SfxItemSet* pSet, const SwNode& rNd,
 diff --git a/sw/source/filter/ww8/rtfexport.hxx b/sw/source/filter/ww8/rtfexport.hxx
 index 869a888e9b25..b470ef593f30 100644
 --- a/sw/source/filter/ww8/rtfexport.hxx
 +++ b/sw/source/filter/ww8/rtfexport.hxx
@@ -117,7 +117,7 @@ public:
 protected:
     /// Format-dependent part of the actual export.
 -    void ExportDocument_Impl() override;
 +    ErrCode ExportDocument_Impl() override;
     void SectionBreaksAndFrames(const SwTextNode& /*rNode*/) override {}
 diff --git a/sw/source/filter/ww8/wrtww8.cxx b/sw/source/filter/ww8/wrtww8.cxx
 index 12a8ef8b6f89..66e4448191ba 100644
 --- a/sw/source/filter/ww8/wrtww8.cxx
 +++ b/sw/source/filter/ww8/wrtww8.cxx
@@ -3110,7 +3110,7 @@ namespace
 {
     const sal_uLong WW_BLOCKSIZE = 0x200;
 -    void EncryptRC4(msfilter::MSCodec_Std97& rCtx, SvStream &rIn, SvStream &rOut)
 +    ErrCode EncryptRC4(msfilter::MSCodec_Std97& rCtx, SvStream &rIn, SvStream &rOut)
     {
         rIn.Seek(STREAM_SEEK_TO_END);
         sal_uLong nLen = rIn.Tell();
@@ -3121,14 +3121,17 @@ namespace
         {
             std::size_t nBS = (nLen - nI > WW_BLOCKSIZE) ? WW_BLOCKSIZE : nLen - nI;
             nBS = rIn.ReadBytes(in, nBS);
 -            rCtx.InitCipher(nBlock);
 +            if (!rCtx.InitCipher(nBlock)) {
 +                return ERRCODE_IO_NOTSUPPORTED;
 +            }
             rCtx.Encode(in, nBS, in, nBS);
             rOut.WriteBytes(in, nBS);
         }
 +        return ERRCODE_NONE;
     }
 }
 -void MSWordExportBase::ExportDocument( bool bWriteAll )
 +ErrCode MSWordExportBase::ExportDocument( bool bWriteAll )
 {
     m_nCharFormatStart = DEFAULT_STYLES_COUNT;
     m_nFormatCollStart = m_nCharFormatStart + m_pDoc->GetCharFormats()->size() - 1;
@@ -3195,7 +3198,7 @@ void MSWordExportBase::ExportDocument( bool bWriteAll )
     if ( m_pDoc->getIDocumentDrawModelAccess().GetDrawModel() )
         m_pDoc->getIDocumentDrawModelAccess().GetDrawModel()->GetPage( 0 )->RecalcObjOrdNums();
 -    ExportDocument_Impl();
 +    ErrCode err = ExportDocument_Impl();
     m_aFrames.clear();
@@ -3208,6 +3211,8 @@ void MSWordExportBase::ExportDocument( bool bWriteAll )
     *m_pCurPam = *m_pOrigPam;
     m_pDoc->getIDocumentRedlineAccess().SetRedlineFlags(m_nOrigRedlineFlags);
 +
 +    return err;
 }
 bool SwWW8Writer::InitStd97CodecUpdateMedium( ::msfilter::MSCodec_Std97& rCodec )
@@ -3262,7 +3267,7 @@ bool SwWW8Writer::InitStd97CodecUpdateMedium( ::msfilter::MSCodec_Std97& rCodec
     return ( aEncryptionData.getLength() != 0 );
 }
 -void WW8Export::ExportDocument_Impl()
 +ErrCode WW8Export::ExportDocument_Impl()
 {
     PrepareStorage();
@@ -3360,6 +3365,7 @@ void WW8Export::ExportDocument_Impl()
     StoreDoc1();
 +    ErrCode err = ERRCODE_NONE;
     if ( bEncrypt )
     {
         SvStream *pStrmTemp, *pTableStrmTemp, *pDataStrmTemp;
@@ -3367,10 +3373,17 @@ void WW8Export::ExportDocument_Impl()
         pTableStrmTemp = xTableStrm.get();
         pDataStrmTemp = xDataStrm.get();
 -        if ( pDataStrmTemp && pDataStrmTemp != pStrmTemp)
 -            EncryptRC4(aCtx, *pDataStrm, *pDataStrmTemp);
 +        if ( pDataStrmTemp && pDataStrmTemp != pStrmTemp) {
 +            err = EncryptRC4(aCtx, *pDataStrm, *pDataStrmTemp);
 +            if (err != ERRCODE_NONE) {
 +                goto done;
 +            }
 +        }
 -        EncryptRC4(aCtx, *pTableStrm, *pTableStrmTemp);
 +        err = EncryptRC4(aCtx, *pTableStrm, *pTableStrmTemp);
 +        if (err != ERRCODE_NONE) {
 +            goto done;
 +        }
         // Write Unencrypted Header 52 bytes to the start of the table stream
         // EncryptionVersionInfo (4 bytes): A Version structure where Version.vMajor MUST be 0x0001, and Version.vMinor MUST be 0x0001.
@@ -3388,7 +3401,10 @@ void WW8Export::ExportDocument_Impl()
         pTableStrmTemp->WriteBytes(pSaltData, 16);
         pTableStrmTemp->WriteBytes(pSaltDigest, 16);
 -        EncryptRC4(aCtx, GetWriter().Strm(), *pStrmTemp);
 +        err = EncryptRC4(aCtx, GetWriter().Strm(), *pStrmTemp);
 +        if (err != ERRCODE_NONE) {
 +            goto done;
 +        }
         // Write Unencrypted Fib 68 bytes to the start of the workdocument stream
         pFib->m_fEncrypted = true; // fEncrypted indicates the document is encrypted.
@@ -3398,6 +3414,7 @@ void WW8Export::ExportDocument_Impl()
         pStrmTemp->Seek( 0 );
         pFib->WriteHeader( *pStrmTemp );
 +    done:;
     }
     DELETEZ( m_pGrf );
@@ -3438,6 +3455,8 @@ void WW8Export::ExportDocument_Impl()
         pDataStrm = nullptr;
         GetWriter().GetStorage().Remove(SL::aData);
     }
 +
 +    return err;
 }
 void WW8Export::PrepareStorage()
@@ -3517,16 +3536,17 @@ ErrCode SwWW8Writer::WriteStorage()
     }
     // Do the actual export
 +    ErrCode err = ERRCODE_NONE;
     {
         bool bDot = mpMedium->GetFilter()->GetName().endsWith("Vorlage");
         WW8Export aExport(this, pDoc, pCurPam, pOrigPam, bDot);
         m_pExport = &aExport;
 -        aExport.ExportDocument( bWriteAll );
 +        err = aExport.ExportDocument( bWriteAll );
         m_pExport = nullptr;
     }
     ::EndProgress( pDoc->GetDocShell() );
 -    return ERRCODE_NONE;
 +    return err;
 }
 ErrCode SwWW8Writer::WriteMedium( SfxMedium& )
 diff --git a/sw/source/filter/ww8/wrtww8.hxx b/sw/source/filter/ww8/wrtww8.hxx
 index 7195677f4688..56bea59191d6 100644
 --- a/sw/source/filter/ww8/wrtww8.hxx
 +++ b/sw/source/filter/ww8/wrtww8.hxx
@@ -574,7 +574,7 @@ public:
 public:
     /// The main function to export the document.
 -    void ExportDocument( bool bWriteAll );
 +    ErrCode ExportDocument( bool bWriteAll );
     /// Iterate through the nodes and call the appropriate OutputNode() on them.
     void WriteText();
@@ -788,7 +788,7 @@ public:
 protected:
     /// Format-dependent part of the actual export.
 -    virtual void ExportDocument_Impl() = 0;
 +    virtual ErrCode ExportDocument_Impl() = 0;
     /// Get the next position in the text node to output
     sal_Int32 GetNextPos( SwWW8AttrIter const * pAttrIter, const SwTextNode& rNode, sal_Int32 nAktPos );
@@ -985,7 +985,7 @@ public:
     virtual bool AddSectionBreaksForTOX() const override { return false; }
 private:
     /// Format-dependent part of the actual export.
 -    virtual void ExportDocument_Impl() override;
 +    virtual ErrCode ExportDocument_Impl() override;
     void PrepareStorage();
     void WriteFkpPlcUsw();
 -- 
 2.17.1
--- a/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
+++ b/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
@ -0,0 +1,54 @@
 From eaa66eec69ec311b73521c6ce410a749c810298f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Thu, 20 Apr 2023 20:58:21 +0100
 Subject: [PATCH 3/3] assume IFrame script/macro support isn't needed
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 seems undocumented at least
 Change-Id: I316e4f4f25ddb7cf6b7bac4d856a721b987207a3
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151020
 Tested-by: Jenkins
 Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152150
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 4b679f8e16bc050bc0cc9fa9294413c8115ed239)
 ---
 sfx2/source/doc/iframe.cxx | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)
 diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
 index fce6cb48ea08f..84d724f7c58f3 100644
 --- a/sfx2/source/doc/iframe.cxx
 +++ b/sfx2/source/doc/iframe.cxx
@@ -168,20 +168,16 @@ sal_Bool SAL_CALL IFrameObject::load(
         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
         xTrans->parseStrict( aTargetURL );
 +        INetURLObject aURLObject(aTargetURL.Complete);
 +        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
 +            return false;
 +
         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
 -        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
 -        {
 -            if (pDoc && !pDoc->AdjustMacroMode())
 -                return false;
 -        }
 -
         bool bUpdateAllowed(true);
         if (pDoc)
         {
 -            // perhaps should only check for file targets, but lets default to making it strong
 -            // unless there is a known need to distinguish
             comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
             bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
         }
 -- 
 2.41.0
--- a/SOURCES/0003-copy_paste_error-data1-looks-like-a-copy-paste-error.patch
+++ b/SOURCES/0003-copy_paste_error-data1-looks-like-a-copy-paste-error.patch
@ -0,0 +1,37 @@
 From 22eb26fe2f4ecf57bff0e1bb377f7af2e7a9e7e4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 4 Nov 2020 09:28:02 +0000
 Subject: [PATCH 3/8] copy_paste_error data1 looks like a copy-paste error
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: I937743f8d1789c68ed960c6a5aede0508dfa7bcd
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105282
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 1aa5e450f065bfdae8c354344f23b897f48a166f)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105457
 Tested-by: Jean-Pierre Ledure <jp@ledure.be>
 Reviewed-by: Jean-Pierre Ledure <jp@ledure.be>
 (cherry picked from commit 4a6ca8920afc0bbb8e36869416745d5b0163313c)
 ---
 wizards/source/access2base/access2base.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/wizards/source/access2base/access2base.py b/wizards/source/access2base/access2base.py
 index af14a880cb3d..3cdc758e820d 100644
 --- a/wizards/source/access2base/access2base.py
 +++ b/wizards/source/access2base/access2base.py
@@ -902,7 +902,7 @@ class Basic(object, metaclass = _Singleton):
     @classmethod
     def DateDiff(cls, add, date1, date2, weekstart = 1, yearstart = 1):
         if isinstance(date1, datetime.datetime): date1 = date1.isoformat()
 -        if isinstance(date2, datetime.datetime): date2 = date1.isoformat()
 +        if isinstance(date2, datetime.datetime): date2 = date2.isoformat()
         return cls.M('PyDateDiff', _WRAPPERMODULE, add, date1, date2, weekstart, yearstart)
     @classmethod
 -- 
 2.28.0
--- a/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
+++ b/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
--- a/SOURCES/0004-CVE-2021-25634.patch
+++ b/SOURCES/0004-CVE-2021-25634.patch
@ -0,0 +1,397 @@
 From 9ef423d4e7c85629772131b3216b98e17d7b8d7e Mon Sep 17 00:00:00 2001
 From: Michael Stahl <michael.stahl@allotropia.de>
 Date: Thu, 18 Feb 2021 19:22:31 +0100
 Subject: [PATCH 4/6] CVE-2021-25634
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 xmlsecurity: XSecParser confused about multiple timestamps
 LO writes timestamp both to dc:date and xades:SigningTime elements.
 The parser tries to avoid reading multiple dc:date, preferring the first
 one, but doesn't care about multiple xades:SigningTime, for undocumented
 reasons.
 Ideally something should check all read values for consistency.
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111160
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit 4ab8d9c09a5873ca0aea56dafa1ab34758d52ef7)
 xmlsecurity: remove XSecController::setPropertyId()
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111252
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit d2a345e1163616fe3201ef1d6c758e2e819214e0)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111908
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit abe77c4fcb9ea97d9fff07eaea6d8863bcba5b02)
 Change-Id: Ic018ee89797a1c8a4f870ae102af48006de930ef
 ---
 include/svl/sigstruct.hxx                    |  7 +-
 xmlsecurity/inc/xsecctl.hxx                  |  5 +-
 xmlsecurity/source/helper/ooxmlsecparser.cxx |  4 +-
 xmlsecurity/source/helper/xsecctl.cxx        |  2 +-
 xmlsecurity/source/helper/xsecparser.cxx     | 81 ++++++++++----------
 xmlsecurity/source/helper/xsecparser.hxx     |  6 --
 xmlsecurity/source/helper/xsecsign.cxx       |  4 +-
 xmlsecurity/source/helper/xsecverify.cxx     | 39 ++++------
 8 files changed, 68 insertions(+), 80 deletions(-)
 diff --git a/include/svl/sigstruct.hxx b/include/svl/sigstruct.hxx
 index f6ee242c84d1..7a0296fa9fae 100644
 --- a/include/svl/sigstruct.hxx
 +++ b/include/svl/sigstruct.hxx
@@ -103,6 +103,9 @@ struct SignatureInformation
     // XAdES EncapsulatedX509Certificate values
     std::set<OUString> maEncapsulatedX509Certificates;
 +    OUString ouSignatureId;
 +    // signature may contain multiple time stamps - check they're consistent
 +    bool hasInconsistentSigningTime = false;
     //We also keep the date and time as string. This is done when this
     //structure is created as a result of a XML signature being read.
     //When then a signature is added or another removed, then the original
@@ -115,8 +118,8 @@ struct SignatureInformation
     //and the converted time is written back, then the string looks different
     //and the signature is broken.
     OUString ouDateTime;
 -    OUString ouSignatureId;
 -    OUString ouPropertyId;
 +    /// The Id attribute of the <SignatureProperty> element that contains the <dc:date>.
 +    OUString ouDateTimePropertyId;
     /// Characters of the <dc:description> element inside the signature.
     OUString ouDescription;
     /// The Id attribute of the <SignatureProperty> element that contains the <dc:description>.
 diff --git a/xmlsecurity/inc/xsecctl.hxx b/xmlsecurity/inc/xsecctl.hxx
 index 351c94a2a3e6..7baa219fb13c 100644
 --- a/xmlsecurity/inc/xsecctl.hxx
 +++ b/xmlsecurity/inc/xsecctl.hxx
@@ -271,8 +271,8 @@ private:
     void setGpgCertificate( OUString const & ouGpgCert );
     void setGpgOwner( OUString const & ouGpgOwner );
 -    void setDate( OUString const & ouDate );
 -    void setDescription(const OUString& rDescription);
 +    void setDate(OUString const& rId, OUString const& ouDate);
 +    void setDescription(OUString const& rId, OUString const& rDescription);
     void setCertDigest(const OUString& rCertDigest);
     void setValidSignatureImage(const OUString& rValidSigImg);
     void setInvalidSignatureImage(const OUString& rInvalidSigImg);
@@ -283,7 +283,6 @@ public:
 private:
     void setId( OUString const & ouId );
 -    void setPropertyId( OUString const & ouPropertyId );
     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToRead(
         sal_Int32 nSecurityId );
 diff --git a/xmlsecurity/source/helper/ooxmlsecparser.cxx b/xmlsecurity/source/helper/ooxmlsecparser.cxx
 index c22e8c2261bf..a200de60c07a 100644
 --- a/xmlsecurity/source/helper/ooxmlsecparser.cxx
 +++ b/xmlsecurity/source/helper/ooxmlsecparser.cxx
@@ -192,12 +192,12 @@ void SAL_CALL OOXMLSecParser::endElement(const OUString& rName)
     }
     else if (rName == "mdssi:Value")
     {
 -        m_pXSecController->setDate(m_aMdssiValue);
 +        m_pXSecController->setDate("", m_aMdssiValue);
         m_bInMdssiValue = false;
     }
     else if (rName == "SignatureComments")
     {
 -        m_pXSecController->setDescription(m_aSignatureComments);
 +        m_pXSecController->setDescription("", m_aSignatureComments);
         m_bInSignatureComments = false;
     }
     else if (rName == "X509IssuerName")
 diff --git a/xmlsecurity/source/helper/xsecctl.cxx b/xmlsecurity/source/helper/xsecctl.cxx
 index ab108d13c224..8d5ea68c768b 100644
 --- a/xmlsecurity/source/helper/xsecctl.cxx
 +++ b/xmlsecurity/source/helper/xsecctl.cxx
@@ -819,7 +819,7 @@ void XSecController::exportSignature(
                 pAttributeList = new SvXMLAttributeList();
                 pAttributeList->AddAttribute(
                     "Id",
 -                    signatureInfo.ouPropertyId);
 +                    signatureInfo.ouDateTimePropertyId);
                 pAttributeList->AddAttribute(
                     "Target",
                     "#" + signatureInfo.ouSignatureId);
 diff --git a/xmlsecurity/source/helper/xsecparser.cxx b/xmlsecurity/source/helper/xsecparser.cxx
 index 5c92e5efa104..9cc9312b4d9f 100644
 --- a/xmlsecurity/source/helper/xsecparser.cxx
 +++ b/xmlsecurity/source/helper/xsecparser.cxx
@@ -978,6 +978,9 @@ class XSecParser::XadesSigningCertificateContext
 class XSecParser::XadesSigningTimeContext
     : public XSecParser::Context
 {
 +    private:
 +        OUString m_Value;
 +
     public:
         XadesSigningTimeContext(XSecParser & rParser,
                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
@@ -985,20 +988,14 @@ class XSecParser::XadesSigningTimeContext
         {
         }
 -        virtual void StartElement(
 -            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
 -        {
 -            m_rParser.m_ouDate.clear();
 -        }
 -
         virtual void EndElement() override
         {
 -            m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
 +            m_rParser.m_pXSecController->setDate("", m_Value);
         }
         virtual void Characters(OUString const& rChars) override
         {
 -            m_rParser.m_ouDate += rChars;
 +            m_Value += rChars;
         }
 };
@@ -1104,35 +1101,20 @@ class XSecParser::DcDateContext
     : public XSecParser::Context
 {
     private:
 -        bool m_isIgnore = false;
 +        OUString & m_rValue;
     public:
         DcDateContext(XSecParser & rParser,
 -                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
 +                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
 +                OUString & rValue)
             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
 +            , m_rValue(rValue)
         {
         }
 -        virtual void StartElement(
 -            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
 -        {
 -            m_isIgnore = !m_rParser.m_ouDate.isEmpty();
 -        }
 -
 -        virtual void EndElement() override
 -        {
 -            if (!m_isIgnore)
 -            {
 -                m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
 -            }
 -        }
 -
         virtual void Characters(OUString const& rChars) override
         {
 -            if (!m_isIgnore)
 -            {
 -                m_rParser.m_ouDate += rChars;
 -            }
 +            m_rValue += rChars;
         }
 };
@@ -1140,29 +1122,32 @@ class XSecParser::DcDescriptionContext
     : public XSecParser::Context
 {
     private:
 -        OUString m_Value;
 +        OUString & m_rValue;
     public:
         DcDescriptionContext(XSecParser & rParser,
 -                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
 +                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
 +                OUString & rValue)
             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
 +            , m_rValue(rValue)
         {
         }
 -        virtual void EndElement() override
 -        {
 -            m_rParser.m_pXSecController->setDescription(m_Value);
 -        }
 -
         virtual void Characters(OUString const& rChars) override
         {
 -            m_Value += rChars;
 +            m_rValue += rChars;
         }
 };
 class XSecParser::DsSignaturePropertyContext
     : public XSecParser::Context
 {
 +    private:
 +        enum class SignatureProperty { Unknown, Date, Description };
 +        SignatureProperty m_Property = SignatureProperty::Unknown;
 +        OUString m_Id;
 +        OUString m_Value;
 +
     public:
         DsSignaturePropertyContext(XSecParser & rParser,
                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
@@ -1173,10 +1158,22 @@ class XSecParser::DsSignaturePropertyContext
         virtual void StartElement(
             css::uno::Reference<css::xml::sax::XAttributeList> const& xAttrs) override
         {
 -            OUString const ouIdAttr(m_rParser.HandleIdAttr(xAttrs));
 -            if (!ouIdAttr.isEmpty())
 +            m_Id = m_rParser.HandleIdAttr(xAttrs);
 +        }
 +
 +        virtual void EndElement() override
 +        {
 +            switch (m_Property)
             {
 -                m_rParser.m_pXSecController->setPropertyId( ouIdAttr );
 +                case SignatureProperty::Unknown:
 +                    SAL_INFO("xmlsecurity.helper", "Unknown property in ds:Object ignored");
 +                    break;
 +                case SignatureProperty::Date:
 +                    m_rParser.m_pXSecController->setDate(m_Id, m_Value);
 +                    break;
 +                case SignatureProperty::Description:
 +                    m_rParser.m_pXSecController->setDescription(m_Id, m_Value);
 +                    break;
             }
         }
@@ -1186,11 +1183,13 @@ class XSecParser::DsSignaturePropertyContext
         {
             if (nNamespace == XML_NAMESPACE_DC && rName == "date")
             {
 -                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap));
 +                m_Property = SignatureProperty::Date;
 +                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
             }
             if (nNamespace == XML_NAMESPACE_DC && rName == "description")
             {
 -                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap));
 +                m_Property = SignatureProperty::Description;
 +                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
             }
             return XSecParser::Context::CreateChildContext(std::move(pOldNamespaceMap), nNamespace, rName);
         }
 diff --git a/xmlsecurity/source/helper/xsecparser.hxx b/xmlsecurity/source/helper/xsecparser.hxx
 index 93efcb766e3e..7a0eb08bca28 100644
 --- a/xmlsecurity/source/helper/xsecparser.hxx
 +++ b/xmlsecurity/source/helper/xsecparser.hxx
@@ -97,12 +97,6 @@ private:
     class DsSignatureContext;
     class DsigSignaturesContext;
 -    /*
 -     * the following members are used to reserve the signature information,
 -     * including X509IssuerName, X509SerialNumber, and X509Certificate,etc.
 -     */
 -    OUString m_ouDate;
 -
     std::stack<std::unique_ptr<Context>> m_ContextStack;
     std::unique_ptr<SvXMLNamespaceMap> m_pNamespaceMap;
 diff --git a/xmlsecurity/source/helper/xsecsign.cxx b/xmlsecurity/source/helper/xsecsign.cxx
 index 4d1b89949feb..5ed23281f083 100644
 --- a/xmlsecurity/source/helper/xsecsign.cxx
 +++ b/xmlsecurity/source/helper/xsecsign.cxx
@@ -132,8 +132,8 @@ cssu::Reference< cssxc::sax::XReferenceResolvedListener > XSecController::prepar
     if (nStorageFormat != embed::StorageFormats::OFOPXML)
     {
         internalSignatureInfor.signatureInfor.ouSignatureId = createId();
 -        internalSignatureInfor.signatureInfor.ouPropertyId = createId();
 -        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouPropertyId, -1, OUString() );
 +        internalSignatureInfor.signatureInfor.ouDateTimePropertyId = createId();
 +        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouDateTimePropertyId, -1, OUString() );
         size++;
         if (bXAdESCompliantIfODF)
 diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx
 index 1f7fa9ac8ca8..5f5840334254 100644
 --- a/xmlsecurity/source/helper/xsecverify.cxx
 +++ b/xmlsecurity/source/helper/xsecverify.cxx
@@ -321,7 +321,7 @@ void XSecController::setGpgOwner( OUString const & ouGpgOwner )
     isi.signatureInfor.ouGpgOwner = ouGpgOwner;
 }
 -void XSecController::setDate( OUString const & ouDate )
 +void XSecController::setDate(OUString const& rId, OUString const& ouDate)
 {
     if (m_vInternalSignatureInformations.empty())
     {
@@ -329,17 +329,31 @@ void XSecController::setDate( OUString const & ouDate )
         return;
     }
     InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
 +    // there may be multiple timestamps in a signature - check them for consistency
 +    if (!isi.signatureInfor.ouDateTime.isEmpty()
 +        && isi.signatureInfor.ouDateTime != ouDate)
 +    {
 +        isi.signatureInfor.hasInconsistentSigningTime = true;
 +    }
     (void)utl::ISO8601parseDateTime( ouDate, isi.signatureInfor.stDateTime);
     isi.signatureInfor.ouDateTime = ouDate;
 +    if (!rId.isEmpty())
 +    {
 +        isi.signatureInfor.ouDateTimePropertyId = rId;
 +    }
 }
 -void XSecController::setDescription(const OUString& rDescription)
 +void XSecController::setDescription(OUString const& rId, OUString const& rDescription)
 {
     if (m_vInternalSignatureInformations.empty())
         return;
     InternalSignatureInformation& rInformation = m_vInternalSignatureInformations.back();
     rInformation.signatureInfor.ouDescription = rDescription;
 +    if (!rId.isEmpty())
 +    {
 +        rInformation.signatureInfor.ouDescriptionPropertyId = rId;
 +    }
 }
 void XSecController::setSignatureBytes(const uno::Sequence<sal_Int8>& rBytes)
@@ -433,27 +447,6 @@ void XSecController::setId( OUString const & ouId )
     isi.signatureInfor.ouSignatureId = ouId;
 }
 -void XSecController::setPropertyId( OUString const & ouPropertyId )
 -{
 -    if (m_vInternalSignatureInformations.empty())
 -    {
 -        SAL_INFO("xmlsecurity.helper","XSecController::setPropertyId: no signature");
 -        return;
 -    }
 -    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
 -
 -    if (isi.signatureInfor.ouPropertyId.isEmpty())
 -    {
 -        // <SignatureProperty> ID attribute is for the date.
 -        isi.signatureInfor.ouPropertyId = ouPropertyId;
 -    }
 -    else
 -    {
 -        // <SignatureProperty> ID attribute is for the description.
 -        isi.signatureInfor.ouDescriptionPropertyId = ouPropertyId;
 -    }
 -}
 -
 /* public: for signature verify */
 void XSecController::collectToVerify( const OUString& referenceId )
 {
 -- 
 2.32.0
--- a/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
+++ b/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
@ -0,0 +1,117 @@
 From 4cfd591942e4cfd3efc416bfac8e46e3580d37ba Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 23 Mar 2022 13:03:30 +0000
 Subject: [PATCH] add infobar to prompt to refresh to replace old format
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131976
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 (cherry picked from commit bbd196ff82bda9f66b4ba32a412f10cefe6da60e)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132307
 Reviewed-by: Sophie Gautier <sophi@libreoffice.org>
 Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
 (cherry picked from commit c5d01b11db3c83cb4a89d3b388d78e20dd3990b5)
 Change-Id: Id99cbf2b50a4ebf289dae6fc67e22e20afcda35b
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133906
 Tested-by: Michael Stahl <michael.stahl@allotropia.de>
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 ---
 include/sfx2/strings.hrc     |  2 ++
 include/sfx2/viewfrm.hxx     |  1 +
 sfx2/source/view/viewfrm.cxx | 40 ++++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
 index 1f21f0a0f186..1db36e733c0c 100644
 --- a/include/sfx2/strings.hrc
 +++ b/include/sfx2/strings.hrc
@@ -297,6 +297,8 @@
 #define STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK   NC_("STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK", "The certificate could not be validated and the document is only partially signed.")
 #define STR_SIGNATURE_OK                        NC_("STR_SIGNATURE_OK", "This document is digitally signed and the signature is valid.")
 #define STR_SIGNATURE_SHOW                      NC_("STR_SIGNATURE_SHOW", "Show Signatures")
 +#define STR_REFRESH_MASTER_PASSWORD             NC_("STR_REFRESH_MASTER_PASSWORD", "The master password is stored in an outdated format, you should refresh it")
 +#define STR_REFRESH_PASSWORD                    NC_("STR_REFRESH_PASSWORD", "Refresh Password")
 #define STR_CLOSE_PANE                          NC_("STR_CLOSE_PANE", "Close Pane")
 #define STR_SFX_DOCK                            NC_("STR_SFX_DOCK", "Dock")
 diff --git a/include/sfx2/viewfrm.hxx b/include/sfx2/viewfrm.hxx
 index fe336ba5f091..cc6a7dae7047 100644
 --- a/include/sfx2/viewfrm.hxx
 +++ b/include/sfx2/viewfrm.hxx
@@ -61,6 +61,7 @@ protected:
     DECL_LINK(WhatsNewHandler, Button*, void);
     DECL_LINK(SwitchReadOnlyHandler, Button*, void);
     DECL_LINK(SignDocumentHandler, Button*, void);
 +    DECL_DLLPRIVATE_LINK(RefreshMasterPasswordHdl, Button*, void);
     SAL_DLLPRIVATE void KillDispatcher_Impl();
     virtual                 ~SfxViewFrame() override;
 diff --git a/sfx2/source/view/viewfrm.cxx b/sfx2/source/view/viewfrm.cxx
 index 5a64599e5894..86e7d51bbfea 100644
 --- a/sfx2/source/view/viewfrm.cxx
 +++ b/sfx2/source/view/viewfrm.cxx
@@ -32,6 +32,7 @@
 #include <com/sun/star/frame/XLoadable.hpp>
 #include <com/sun/star/frame/XLayoutManager.hpp>
 #include <com/sun/star/frame/XComponentLoader.hpp>
 +#include <com/sun/star/task/PasswordContainer.hpp>
 #include <officecfg/Office/Common.hxx>
 #include <officecfg/Setup.hxx>
 #include <toolkit/helper/vclunohelper.hxx>
@@ -1390,6 +1391,24 @@ void SfxViewFrame::Notify( SfxBroadcaster& /*rBC*/, const SfxHint& rHint )
                     batch->commit();
                 }
 +                if (officecfg::Office::Common::Passwords::HasMaster::get() &&
 +                    officecfg::Office::Common::Passwords::StorageVersion::get() == 0)
 +                {
 +                    // master password stored in deprecated format
 +                    VclPtr<SfxInfoBarWindow> pOldMasterPasswordInfoBar =
 +                        AppendInfoBar("oldmasterpassword", "",
 +                                      SfxResId(STR_REFRESH_MASTER_PASSWORD), InfobarType::DANGER, false);
 +                    if (pOldMasterPasswordInfoBar)
 +                    {
 +                        VclPtrInstance<PushButton> const xBtn(&GetWindow());
 +                        xBtn->SetText(SfxResId(STR_REFRESH_PASSWORD));
 +                        xBtn->SetSizePixel(xBtn->GetOptimalSize());
 +                        xBtn->SetClickHdl(LINK(this,
 +                           SfxViewFrame, RefreshMasterPasswordHdl));
 +                        pOldMasterPasswordInfoBar->addButton(xBtn);
 +                    }
 +                }
 +
                 // read-only infobar if necessary
                 const SfxViewShell *pVSh;
                 const SfxShell *pFSh;
@@ -1565,6 +1584,27 @@ IMPL_LINK_NOARG(SfxViewFrame, SignDocumentHandler, Button*, void)
     GetDispatcher()->Execute(SID_SIGNATURE);
 }
 +IMPL_LINK_NOARG(SfxViewFrame, RefreshMasterPasswordHdl, Button*, void)
 +{
 +    bool bChanged = false;
 +    try
 +    {
 +        Reference< task::XPasswordContainer2 > xMasterPasswd(
 +            task::PasswordContainer::create(comphelper::getProcessComponentContext()));
 +
 +        css::uno::Reference<css::frame::XFrame> xFrame = GetFrame().GetFrameInterface();
 +        css::uno::Reference<css::awt::XWindow> xContainerWindow = xFrame->getContainerWindow();
 +
 +        uno::Reference<task::XInteractionHandler> xTmpHandler(task::InteractionHandler::createWithParent(comphelper::getProcessComponentContext(),
 +                                                              xContainerWindow));
 +        bChanged = xMasterPasswd->changeMasterPassword(xTmpHandler);
 +    }
 +    catch (const Exception&)
 +    {}
 +    if (bChanged)
 +        RemoveInfoBar(u"oldmasterpassword");
 +}
 +
 void SfxViewFrame::Construct_Impl( SfxObjectShell *pObjSh )
 {
     m_pImpl->bResizeInToOut = true;
 -- 
 2.37.1
--- a/SOURCES/0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch
+++ b/SOURCES/0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch
@ -0,0 +1,281 @@
 From 6a69b533227ae22d97824317f14dfa6991959101 Mon Sep 17 00:00:00 2001
 Message-ID: <6a69b533227ae22d97824317f14dfa6991959101.1703086328.git.erack@redhat.com>
 In-Reply-To: <82752ccba78ecdbf94908377ec022f68ba7d9d59.1703086328.git.erack@redhat.com>
 References: <82752ccba78ecdbf94908377ec022f68ba7d9d59.1703086328.git.erack@redhat.com>
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Wed, 15 Nov 2023 11:39:24 +0000
 Subject: [PATCH 3/4] reuse AllowedLinkProtocolFromDocument in writer
 MIME-Version: 1.0
 Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
 This is a multi-part message in MIME format.
 --------------erAck-patch-parts
 Content-Type: text/plain; charset=UTF-8; format=fixed
 Content-Transfer-Encoding: 8bit
 reorg calc hyperlink check to reuse elsewhere
 Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)
 reuse AllowedLinkProtocolFromDocument in writer
 Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)
 combine these hyperlink dispatchers into one call
 Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)
 we can have just one LoadURL for writer
 Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 (cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159883
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159913
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 Reviewed-by: Eike Rathke <erack@redhat.com>
 ---
 include/sfx2/objsh.hxx               |  7 +++--
 sc/source/core/data/global.cxx       | 32 ++---------------------
 sfx2/source/doc/objmisc.cxx          | 27 ++++++++++++++++++++
 sw/source/uibase/shells/drwtxtex.cxx |  8 ++----
 sw/source/uibase/wrtsh/wrtsh2.cxx    | 38 ++++++++++++++++++----------
 5 files changed, 60 insertions(+), 52 deletions(-)
 --------------erAck-patch-parts
 Content-Type: text/x-patch; name="0003-reuse-AllowedLinkProtocolFromDocument-in-writer.patch"
 Content-Transfer-Encoding: 8bit
 Content-Disposition: attachment; filename="0003-reuse-AllowedLinkProtocolFromDocument-in-writer.patch"
 diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
 index fde0dba3d7c9..79f22c978dcb 100644
 --- a/include/sfx2/objsh.hxx
 +++ b/include/sfx2/objsh.hxx
@@ -200,6 +200,9 @@ private:
     SAL_DLLPRIVATE bool SaveTo_Impl(SfxMedium &rMedium, const SfxItemSet* pSet );
 +    // true if the document had macros (or similar) on load to trigger warning user
 +    SAL_DLLPRIVATE bool  GetHadCheckedMacrosOnLoad() const;
 +
 protected:
                                 SfxObjectShell(SfxObjectCreateMode);
                                 SfxObjectShell(SfxModelFlags);    // see sfxmodelfactory.hxx
@@ -427,8 +430,8 @@ public:
     void                        SetMacroCallsSeenWhileLoading();
     bool                        GetMacroCallsSeenWhileLoading() const;
 -    // true if the document had macros (or similar) on load to trigger warning user
 -    bool                        GetHadCheckedMacrosOnLoad() const;
 +    // true if this type of link, from a document, is allowed by the user to be passed to uno:OpenDoc
 +    static bool                 AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent);
     const css::uno::Sequence< css::beans::PropertyValue >& GetModifyPasswordInfo() const;
     bool                        SetModifyPasswordInfo( const css::uno::Sequence< css::beans::PropertyValue >& aInfo );
 diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
 index 92caea1ea459..27c5a51a46c1 100644
 --- a/sc/source/core/data/global.cxx
 +++ b/sc/source/core/data/global.cxx
@@ -29,9 +29,7 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/dispatch.hxx>
 #include <sfx2/objsh.hxx>
 -#include <sfx2/sfxresid.hxx>
 #include <sfx2/sfxsids.hrc>
 -#include <sfx2/strings.hrc>
 #include <sfx2/viewfrm.hxx>
 #include <sfx2/viewsh.hxx>
 #include <svl/intitem.hxx>
@@ -856,34 +854,8 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
             aUrlName = aNewUrlName;
     }
 -    if (INetURLObject(aUrlName).IsExoticProtocol())
 -    {
 -        // Default to ignoring exotic protocols
 -        bool bAllow = false;
 -        if (pObjShell)
 -        {
 -            // If the document had macros when loaded then follow the allowed macro-mode
 -            if (pObjShell->GetHadCheckedMacrosOnLoad())
 -                bAllow = pObjShell->AdjustMacroMode();
 -            else // otherwise ask the user, defaulting to cancel
 -            {
 -                assert(pFrame && "if we have pObjShell we have pFrame");
 -                //Reuse URITools::onOpenURI warning string
 -                std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pFrame->GetFrameWeld(),
 -                                                               VclMessageType::Warning, VclButtonsType::YesNo,
 -                                                               SfxResId(STR_DANGEROUS_TO_OPEN)));
 -                xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
 -                    INetURLObject::decode(aUrlName, INetURLObject::DecodeMechanism::Unambiguous)));
 -                xQueryBox->set_default_response(RET_NO);
 -                bAllow = xQueryBox->run() == RET_YES;
 -            }
 -        }
 -        if (!bAllow)
 -        {
 -            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
 -            return;
 -        }
 -    }
 +    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetFrameWeld() : nullptr))
 +        return;
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
 diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
 index ddf95eeafe5e..8c76c3f0f4d6 100644
 --- a/sfx2/source/doc/objmisc.cxx
 +++ b/sfx2/source/doc/objmisc.cxx
@@ -962,6 +962,33 @@ bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
     return pImpl->m_bHadCheckedMacrosOnLoad;
 }
 +bool SfxObjectShell::AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent)
 +{
 +    if (!INetURLObject(rUrl).IsExoticProtocol())
 +        return true;
 +    // Default to ignoring exotic protocols
 +    bool bAllow = false;
 +    if (pObjShell)
 +    {
 +        // If the document had macros when loaded then follow the allowed macro-mode
 +        if (pObjShell->GetHadCheckedMacrosOnLoad())
 +            bAllow = pObjShell->AdjustMacroMode();
 +        else // otherwise ask the user, defaulting to cancel
 +        {
 +            //Reuse URITools::onOpenURI warning string
 +            std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pDialogParent,
 +                                                           VclMessageType::Warning, VclButtonsType::YesNo,
 +                                                           SfxResId(STR_DANGEROUS_TO_OPEN)));
 +            xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
 +                INetURLObject::decode(rUrl, INetURLObject::DecodeMechanism::Unambiguous)));
 +            xQueryBox->set_default_response(RET_NO);
 +            bAllow = xQueryBox->run() == RET_YES;
 +        }
 +    }
 +    SAL_WARN_IF(!bAllow, "sfx.appl", "SfxObjectShell::AllowedLinkProtocolFromDocument ignoring: " << rUrl);
 +    return bAllow;
 +}
 +
 void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
 {
     OUString aVersion;
 diff --git a/sw/source/uibase/shells/drwtxtex.cxx b/sw/source/uibase/shells/drwtxtex.cxx
 index c84ee7bd9af4..c51f501841ad 100644
 --- a/sw/source/uibase/shells/drwtxtex.cxx
 +++ b/sw/source/uibase/shells/drwtxtex.cxx
@@ -533,12 +533,8 @@ void SwDrawTextShell::Execute( SfxRequest &rReq )
             const SvxFieldData* pField = pOLV->GetFieldAtCursor();
             if (const SvxURLField* pURLField = dynamic_cast<const SvxURLField*>(pField))
             {
 -                SfxStringItem aUrl(SID_FILE_NAME, pURLField->GetURL());
 -                SfxStringItem aTarget(SID_TARGETNAME, pURLField->GetTargetFrame());
 -                SfxBoolItem aNewView(SID_OPEN_NEW_VIEW, false);
 -                SfxBoolItem aBrowsing(SID_BROWSE, true);
 -                GetView().GetViewFrame()->GetDispatcher()->ExecuteList(
 -                    SID_OPENDOC, SfxCallMode::SYNCHRON, { &aUrl, &aTarget, &aNewView, &aBrowsing });
 +                ::LoadURL(GetShell(), pURLField->GetURL(), LoadUrlFlags::NONE,
 +                          pURLField->GetTargetFrame());
             }
         }
         break;
 diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx
 index 1995e7133c4a..d781823e82ec 100644
 --- a/sw/source/uibase/wrtsh/wrtsh2.cxx
 +++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
@@ -501,30 +501,24 @@ bool SwWrtShell::ClickToINetGrf( const Point& rDocPt, LoadUrlFlags nFilter )
     return bRet;
 }
 -void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
 -              const OUString& rTargetFrameName )
 +static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
 +                    const OUString& rTargetFrameName)
 {
 -    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
 -    if( rURL.isEmpty() )
 -        return ;
 +    SwDocShell* pDShell = rView.GetDocShell();
 +    OSL_ENSURE( pDShell, "No DocShell?!");
 +    SfxViewFrame* pViewFrame = rView.GetViewFrame();
 -    // The shell could be 0 also!!!!!
 -    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
 +    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetFrameWeld()))
         return;
     // We are doing tiledRendering, let the client handles the URL loading,
     // unless we are jumping to a TOC mark.
     if (comphelper::LibreOfficeKit::isActive() && !rURL.startsWith("#"))
     {
 -        rVSh.GetSfxViewShell()->libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
 +        rView.libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
         return;
     }
 -    //A CursorShell is always a WrtShell
 -    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
 -
 -    SwDocShell* pDShell = rSh.GetView().GetDocShell();
 -    OSL_ENSURE( pDShell, "No DocShell?!");
     OUString sTargetFrame(rTargetFrameName);
     if (sTargetFrame.isEmpty() && pDShell)
     {
@@ -539,7 +533,6 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
     OUString sReferer;
     if( pDShell && pDShell->GetMedium() )
         sReferer = pDShell->GetMedium()->GetName();
 -    SfxViewFrame* pViewFrame = rSh.GetView().GetViewFrame();
     SfxFrameItem aView( SID_DOCFRAME, pViewFrame );
     SfxStringItem aName( SID_FILE_NAME, rURL );
     SfxStringItem aTargetFrameName( SID_TARGETNAME, sTargetFrame );
@@ -565,6 +558,23 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
             SfxCallMode::ASYNCHRON|SfxCallMode::RECORD );
 }
 +void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
 +              const OUString& rTargetFrameName )
 +{
 +    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
 +    if( rURL.isEmpty() )
 +        return ;
 +
 +    // The shell could be 0 also!!!!!
 +    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
 +        return;
 +
 +    //A CursorShell is always a WrtShell
 +    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
 +
 +    ::LoadURL(rSh.GetView(), rURL, nFilter, rTargetFrameName);
 +}
 +
 void SwWrtShell::NavigatorPaste( const NaviContentBookmark& rBkmk,
                                     const sal_uInt16 nAction )
 {
 --------------erAck-patch-parts--
--- a/SOURCES/0004-Fix-use-of-uninitialized-SwFEShell-bTableCopied.patch
+++ b/SOURCES/0004-Fix-use-of-uninitialized-SwFEShell-bTableCopied.patch
@ -0,0 +1,74 @@
 From cba3b6a12c9f0dc67a93bc3b708497a8f5eea5a5 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Sun, 15 Dec 2019 10:03:56 +0100
 Subject: [PATCH 4/8] Fix use of uninitialized SwFEShell::bTableCopied
 ...which had been introduced with 1e278d1d0cfb1d5375195aa764739f00633f21e8
 "tdf#37156 Writer menu: Paste as Nested table", during
 `make CppunitTest_sw_uiwriter CPPUNIT_TEST_NAME=SwUiWriterTest::testDde
 VALGRIND=memcheck`:
 > Conditional jump or move depends on uninitialised value(s)
 >    at 0x1EBBFAF8: SwTransferable::PrepareForCopy(bool) (sw/source/uibase/dochdl/swdtflvr.cxx:896)
 >    by 0x1EBC22BA: SwTransferable::Copy(bool) (sw/source/uibase/dochdl/swdtflvr.cxx:1144)
 >    by 0x1ECB552D: SwBaseShell::ExecClpbrd(SfxRequest&) (sw/source/uibase/shells/basesh.cxx:277)
 >    by 0x1C0D0BB0: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (include/sfx2/shell.hxx:197)
 >    by 0x1C0D72EB: SfxDispatcher::Execute_(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (sfx2/source/control/dispatch.cxx:764)
 >    by 0x1C153977: SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (sfx2/source/control/unoctitm.cxx:760)
 >    by 0x1C154916: SfxOfficeDispatch::dispatchWithNotification(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (sfx2/source/control/unoctitm.cxx:245)
 >    by 0x21FDE395: framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatch> const&, com::sun::star::util::URL const&, bool, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/dispatchhelper.cxx:151)
 >    by 0x21FDEC95: framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatchProvider> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/dispatchhelper.cxx:109)
 >    by 0x19BF89C7: lcl_dispatchCommand(com::sun::star::uno::Reference<com::sun::star::lang::XComponent> const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (sw/qa/extras/uiwriter/uiwriter.cxx:4048)
 >    by 0x19C1F3EC: SwUiWriterTest::testDde() (sw/qa/extras/uiwriter/uiwriter.cxx:4060)
 >  Uninitialised value was created by a heap allocation
 >    at 0x4839E86: operator new(unsigned long) (/builddir/build/BUILD/valgrind-3.15.0/coregrind/m_replacemalloc/vg_replace_malloc.c:344)
 >    by 0x1ED6DA43: SwView::SwView(SfxViewFrame*, SfxViewShell*) (sw/source/uibase/uiview/view.cxx:864)
 >    by 0x1ED70065: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) (sw/source/uibase/uiview/view0.cxx:79)
 >    by 0x1C347941: SfxBaseModel::createViewController(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfx2/source/doc/sfxbasemodel.cxx:4233)
 >    by 0x1C458D81: (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (sfx2/source/view/frmload.cxx:587)
 >    by 0x2401FAD0: framework::LoadEnv::impl_loadContent() (framework/source/loadenv/loadenv.cxx:1159)
 >    by 0x24020735: framework::LoadEnv::start() (framework/source/loadenv/loadenv.cxx:392)
 >    by 0x24020F89: framework::LoadEnv::startLoading(rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, rtl::OUString const&, int, LoadEnvFeatures) (framework/source/loadenv/loadenv.cxx:297)
 >    by 0x2402175B: framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference<com::sun::star::frame::XComponentLoader> const&, com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/loadenv/loadenv.cxx:166)
 >    by 0x24058172: framework::Desktop::loadComponentFromURL(rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (framework/source/services/desktop.cxx:610)
 >    by 0x1F5F7306: unotest::MacrosTest::loadFromDesktop(rtl::OUString const&, rtl::OUString const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (unotest/source/cpp/macros_test.cxx:48)
 >    by 0x19C646A7: SwModelTestBase::loadURL(rtl::OUString const&, char const*, char const*) (sw/qa/inc/swmodeltestbase.hxx:764)
 >    by 0x19BD3792: SwUiWriterTest::createDoc(char const*) (sw/qa/extras/uiwriter/uiwriter.cxx:576)
 >    by 0x19C1F352: SwUiWriterTest::testDde() (sw/qa/extras/uiwriter/uiwriter.cxx:4055)
 (produced with a --enable-optimized build, so some inline frames are elided; see
 also <https://ci.libreoffice.org//job/lo_ubsan/1480/> for the same issue
 detected with UBSan).
 Change-Id: I080d296006bad4726942fb95a1338ea46c12bed4
 Reviewed-on: https://gerrit.libreoffice.org/85162
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit bcc74f619bf87ab97ffc48ab33e031d357952a70)
 ---
 sw/source/core/frmedt/fews.cxx | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/sw/source/core/frmedt/fews.cxx b/sw/source/core/frmedt/fews.cxx
 index 2ad7ec20a86f..0c4e097287c2 100644
 --- a/sw/source/core/frmedt/fews.cxx
 +++ b/sw/source/core/frmedt/fews.cxx
@@ -665,6 +665,7 @@ SwFEShell::SwFEShell( SwDoc& rDoc, vcl::Window *pWindow, const SwViewOption *pOp
     , m_bCheckForOLEInCaption(false)
     , m_aPasteListeners(GetPasteMutex())
     , m_eTableInsertMode(SwTable::SEARCH_NONE)
 +    , bTableCopied(false)
 {
 }
@@ -673,6 +674,7 @@ SwFEShell::SwFEShell( SwEditShell& rShell, vcl::Window *pWindow )
     , m_bCheckForOLEInCaption(false)
     , m_aPasteListeners(GetPasteMutex())
     , m_eTableInsertMode(SwTable::SEARCH_NONE)
 +    , bTableCopied(false)
 {
 }
 -- 
 2.28.0
--- a/SOURCES/0004-iRelated-rhbz-1618703-Properly-handle-failure-en-dec.patch
+++ b/SOURCES/0004-iRelated-rhbz-1618703-Properly-handle-failure-en-dec.patch
@ -1,204 +0,0 @@
 From 9207290587ea8c8703486d60877731228eed80ce Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Fri, 24 Aug 2018 10:27:01 +0200
 Subject: [PATCH 4/5] iRelated rhbz#1618703: Properly handle failure
 en-/decoding PDF file
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...when e.g. FIPS mode makes the various calls to rtl_cipher_initARCFOUR fail.
 Reviewed-on: https://gerrit.libreoffice.org/59543
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 185a14525f114e58b48236284ed8e8644bc40e48)
 Reviewed-on: https://gerrit.libreoffice.org/59573
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 68ffc5c83ca73c58439b7c9935283541f007db44)
 Conflicts:
 	filter/source/pdf/impdialog.cxx
 	sdext/source/pdfimport/pdfparse/pdfentries.cxx
 	vcl/source/gdi/pdfwriter_impl2.cxx
 Change-Id: Id1b2222249c151470e233ab814b21228f3a8b561
 ---
 filter/source/pdf/impdialog.cxx               |  7 +++
 .../source/pdfimport/pdfparse/pdfentries.cxx  | 42 +++++++++++-----
 vcl/source/gdi/pdfwriter_impl2.cxx            | 48 +++++++++++--------
 3 files changed, 67 insertions(+), 30 deletions(-)
 diff --git a/filter/source/pdf/impdialog.cxx b/filter/source/pdf/impdialog.cxx
 index 82aaf012505a..736ac0c15f26 100644
 --- a/filter/source/pdf/impdialog.cxx
 +++ b/filter/source/pdf/impdialog.cxx
@@ -23,6 +23,7 @@
 #include <strings.hrc>
 #include <bitmaps.hlst>
 #include <officecfg/Office/Common.hxx>
 +#include <vcl/errinf.hxx>
 #include <vcl/layout.hxx>
 #include <vcl/settings.hxx>
 #include <vcl/svapp.hxx>
@@ -1351,6 +1352,12 @@ IMPL_LINK_NOARG(ImpPDFTabSecurityPage, ClickmaPbSetPwdHdl, Button*, void)
         mbHaveOwnerPassword = !aOwnerPW.isEmpty();
         mxPreparedPasswords = vcl::PDFWriter::InitEncryption( aOwnerPW, aUserPW, true );
 +        if (!mxPreparedPasswords.is()) {
 +            OUString msg;
 +            ErrorHandler::GetErrorString(ERRCODE_IO_NOTSUPPORTED, msg); //TOOD: handle failure
 +            ScopedVclPtrInstance<MessageDialog>(this, msg, VclMessageType::Error)->Execute();
 +            return;
 +        }
         if( mbHaveOwnerPassword )
         {
 diff --git a/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
 index 16563868f25c..074fb669c8da 100644
 --- a/sdext/source/pdfimport/pdfparse/pdfentries.cxx
 +++ b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -1159,9 +1159,13 @@ static bool check_user_password( const OString& rPwd, PDFFileImplData* pData )
     {
         // see PDF reference 1.4 Algorithm 3.4
         // encrypt pad string
 -        rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 -                                aKey, nKeyLen,
 -                                nullptr, 0 );
 +        if (rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 +                                    aKey, nKeyLen,
 +                                    nullptr, 0 )
 +            != rtl_Cipher_E_None)
 +        {
 +            return false; //TODO: differentiate "failed to decrypt" from "wrong password"
 +        }
         rtl_cipher_encodeARCFOUR( pData->m_aCipher, nPadString, sizeof( nPadString ),
                                   nEncryptedEntry, sizeof( nEncryptedEntry ) );
         bValid = (memcmp( nEncryptedEntry, pData->m_aUEntry, 32 ) == 0);
@@ -1172,8 +1176,12 @@ static bool check_user_password( const OString& rPwd, PDFFileImplData* pData )
         rtl_digest_updateMD5( pData->m_aDigest, nPadString, sizeof( nPadString ) );
         rtl_digest_updateMD5( pData->m_aDigest, pData->m_aDocID.getStr(), pData->m_aDocID.getLength() );
         rtl_digest_getMD5( pData->m_aDigest, nEncryptedEntry, sizeof(nEncryptedEntry) );
 -        rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 -                                aKey, sizeof(aKey), nullptr, 0 );
 +        if (rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 +                                    aKey, sizeof(aKey), nullptr, 0 )
 +            != rtl_Cipher_E_None)
 +        {
 +            return false; //TODO: differentiate "failed to decrypt" from "wrong password"
 +        }
         rtl_cipher_encodeARCFOUR( pData->m_aCipher,
                                   nEncryptedEntry, 16,
                                   nEncryptedEntry, 16 ); // encrypt in place
@@ -1183,8 +1191,12 @@ static bool check_user_password( const OString& rPwd, PDFFileImplData* pData )
             for( sal_uInt32 j = 0; j < sizeof(aTempKey); j++ )
                 aTempKey[j] = static_cast<sal_uInt8>( aKey[j] ^ i );
 -            rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 -                                    aTempKey, sizeof(aTempKey), nullptr, 0 );
 +            if (rtl_cipher_initARCFOUR( pData->m_aCipher, rtl_Cipher_DirectionEncode,
 +                                        aTempKey, sizeof(aTempKey), nullptr, 0 )
 +                != rtl_Cipher_E_None)
 +            {
 +                return false; //TODO: differentiate "failed to decrypt" from "wrong password"
 +            }
             rtl_cipher_encodeARCFOUR( pData->m_aCipher,
                                       nEncryptedEntry, 16,
                                       nEncryptedEntry, 16 ); // encrypt in place
@@ -1230,8 +1242,12 @@ bool PDFFile::setupDecryptionData( const OString& rPwd ) const
         sal_uInt32 nKeyLen = password_to_key( rPwd, aKey, m_pData.get(), true );
         if( m_pData->m_nStandardRevision == 2 )
         {
 -            rtl_cipher_initARCFOUR( m_pData->m_aCipher, rtl_Cipher_DirectionDecode,
 -                                    aKey, nKeyLen, nullptr, 0 );
 +            if (rtl_cipher_initARCFOUR( m_pData->m_aCipher, rtl_Cipher_DirectionDecode,
 +                                        aKey, nKeyLen, nullptr, 0 )
 +                != rtl_Cipher_E_None)
 +            {
 +                return false; //TODO: differentiate "failed to decrypt" from "wrong password"
 +            }
             rtl_cipher_decodeARCFOUR( m_pData->m_aCipher,
                                       m_pData->m_aOEntry, 32,
                                       nPwd, 32 );
@@ -1244,8 +1260,12 @@ bool PDFFile::setupDecryptionData( const OString& rPwd ) const
                 sal_uInt8 nTempKey[ENCRYPTION_KEY_LEN];
                 for( unsigned int j = 0; j < sizeof(nTempKey); j++ )
                     nTempKey[j] = sal_uInt8(aKey[j] ^ i);
 -                rtl_cipher_initARCFOUR( m_pData->m_aCipher, rtl_Cipher_DirectionDecode,
 -                                        nTempKey, nKeyLen, nullptr, 0 );
 +                if (rtl_cipher_initARCFOUR( m_pData->m_aCipher, rtl_Cipher_DirectionDecode,
 +                                            nTempKey, nKeyLen, nullptr, 0 )
 +                    != rtl_Cipher_E_None)
 +                {
 +                    return false; //TODO: differentiate "failed to decrypt" from "wrong password"
 +                }
                 rtl_cipher_decodeARCFOUR( m_pData->m_aCipher,
                                           nPwd, 32,
                                           nPwd, 32 ); // decrypt inplace
 diff --git a/vcl/source/gdi/pdfwriter_impl2.cxx b/vcl/source/gdi/pdfwriter_impl2.cxx
 index e4f567d6bfd9..e85cf15e4395 100644
 --- a/vcl/source/gdi/pdfwriter_impl2.cxx
 +++ b/vcl/source/gdi/pdfwriter_impl2.cxx
@@ -1443,29 +1443,39 @@ bool PDFWriterImpl::computeODictionaryValue( const sal_uInt8* i_pPaddedOwnerPass
             //Step 4, the key is in nMD5Sum
             //step 5 already done, data is in i_pPaddedUserPassword
             //step 6
 -            rtl_cipher_initARCFOUR( aCipher, rtl_Cipher_DirectionEncode,
 -                                     nMD5Sum, i_nKeyLength , nullptr, 0 );
 -            // encrypt the user password using the key set above
 -            rtl_cipher_encodeARCFOUR( aCipher, i_pPaddedUserPassword, ENCRYPTED_PWD_SIZE, // the data to be encrypted
 -                                      &io_rOValue[0], sal_Int32(io_rOValue.size()) ); //encrypted data
 -            //Step 7, only if 128 bit
 -            if( i_nKeyLength == SECUR_128BIT_KEY )
 +            if (rtl_cipher_initARCFOUR( aCipher, rtl_Cipher_DirectionEncode,
 +                                        nMD5Sum, i_nKeyLength , nullptr, 0 )
 +                == rtl_Cipher_E_None)
             {
 -                sal_uInt32 i, y;
 -                sal_uInt8 nLocalKey[ SECUR_128BIT_KEY ]; // 16 = 128 bit key
 -
 -                for( i = 1; i <= 19; i++ ) // do it 19 times, start with 1
 +                // encrypt the user password using the key set above
 +                rtl_cipher_encodeARCFOUR( aCipher, i_pPaddedUserPassword, ENCRYPTED_PWD_SIZE, // the data to be encrypted
 +                                          &io_rOValue[0], sal_Int32(io_rOValue.size()) ); //encrypted data
 +                //Step 7, only if 128 bit
 +                if( i_nKeyLength == SECUR_128BIT_KEY )
                 {
 -                    for( y = 0; y < sizeof( nLocalKey ); y++ )
 -                        nLocalKey[y] = (sal_uInt8)( nMD5Sum[y] ^ i );
 -
 -                    rtl_cipher_initARCFOUR( aCipher, rtl_Cipher_DirectionEncode,
 -                                            nLocalKey, SECUR_128BIT_KEY, nullptr, 0 ); //destination data area, on init can be NULL
 -                    rtl_cipher_encodeARCFOUR( aCipher, &io_rOValue[0], sal_Int32(io_rOValue.size()), // the data to be encrypted
 -                                              &io_rOValue[0], sal_Int32(io_rOValue.size()) ); // encrypted data, can be the same as the input, encrypt "in place"
 -                    //step 8, store in class data member
 +                    sal_uInt32 i, y;
 +                    sal_uInt8 nLocalKey[ SECUR_128BIT_KEY ]; // 16 = 128 bit key
 +
 +                    for( i = 1; i <= 19; i++ ) // do it 19 times, start with 1
 +                    {
 +                        for( y = 0; y < sizeof( nLocalKey ); y++ )
 +                            nLocalKey[y] = (sal_uInt8)( nMD5Sum[y] ^ i );
 +
 +                        if (rtl_cipher_initARCFOUR( aCipher, rtl_Cipher_DirectionEncode,
 +                                                    nLocalKey, SECUR_128BIT_KEY, nullptr, 0 ) //destination data area, on init can be NULL
 +                            != rtl_Cipher_E_None)
 +                        {
 +                            bSuccess = false;
 +                            break;
 +                        }
 +                        rtl_cipher_encodeARCFOUR( aCipher, &io_rOValue[0], sal_Int32(io_rOValue.size()), // the data to be encrypted
 +                                                  &io_rOValue[0], sal_Int32(io_rOValue.size()) ); // encrypted data, can be the same as the input, encrypt "in place"
 +                        //step 8, store in class data member
 +                    }
                 }
             }
 +            else
 +                bSuccess = false;
         }
         else
             bSuccess = false;
 -- 
 2.17.1
--- a/SOURCES/0005-CVE-2021-25633.patch
+++ b/SOURCES/0005-CVE-2021-25633.patch
--- a/SOURCES/0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch
+++ b/SOURCES/0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch
@ -0,0 +1,87 @@
 From 62ba88176c10469588e4bbb73cbf33889df08dbc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
 Date: Wed, 22 Nov 2023 21:14:41 +0000
 Subject: [PATCH] reuse AllowedLinkProtocolFromDocument in impress/draw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
 (cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159884
 Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
 Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159914
 Reviewed-by: Eike Rathke <erack@redhat.com>
 erAck: backported to 6.4.7.2
 ---
 sd/source/ui/app/sdmod1.cxx | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)
 diff --git a/sd/source/ui/app/sdmod1.cxx b/sd/source/ui/app/sdmod1.cxx
 index 3d84ddb..8d42653 100644
 --- a/sd/source/ui/app/sdmod1.cxx
 +++ b/sd/source/ui/app/sdmod1.cxx
@@ -32,6 +32,7 @@
 #include <sfx2/dispatch.hxx>
 #include <sfx2/request.hxx>
 #include <sfx2/templatedlg.hxx>
 +#include <svl/stritem.hxx>
 #include <editeng/eeitem.hxx>
 #include <svx/svxids.hrc>
@@ -193,26 +194,32 @@ void SdModule::Execute(SfxRequest& rReq)
         {
             bool bIntercept = false;
             ::sd::DrawDocShell* pDocShell = dynamic_cast< ::sd::DrawDocShell *>( SfxObjectShell::Current() );
 -            if (pDocShell)
 +            ::sd::ViewShell* pViewShell = pDocShell ? pDocShell->GetViewShell() : nullptr;
 +            if (pViewShell)
             {
 -                ::sd::ViewShell* pViewShell = pDocShell->GetViewShell();
 -                if (pViewShell)
 +                if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
                 {
 -                    if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
 +                    // Prevent documents from opening while the slide
 +                    // show is running, except when this request comes
 +                    // from a shape interaction.
 +                    if (rReq.GetArgs() == nullptr)
                     {
 -                        // Prevent documents from opening while the slide
 -                        // show is running, except when this request comes
 -                        // from a shape interaction.
 -                        if (rReq.GetArgs() == nullptr)
 -                        {
 -                            bIntercept = true;
 -                        }
 +                        bIntercept = true;
                     }
                 }
             }
             if (!bIntercept)
             {
 +                if (const SfxStringItem* pURLItem = rReq.GetArg<SfxStringItem>(SID_FILE_NAME))
 +                {
 +                    if (!pViewShell || !SfxObjectShell::AllowedLinkProtocolFromDocument(pURLItem->GetValue(),
 +                                                                                        pViewShell->GetObjectShell(),
 +                                                                                        pViewShell->GetFrameWeld()))
 +                    {
 +                        return;
 +                    }
 +                }
                 SfxGetpApp()->ExecuteSlot(rReq, SfxGetpApp()->GetInterface());
             }
             else
 -- 
 2.43.0
--- a/SOURCES/0005-cid-1460969-Uninitialized-scalar-field.patch
+++ b/SOURCES/0005-cid-1460969-Uninitialized-scalar-field.patch
@ -0,0 +1,35 @@
 From 2ebea3e9f3504ef97ecf8af198cd803a56240fe4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Fri, 27 Mar 2020 09:03:20 +0000
 Subject: [PATCH 5/8] cid#1460969 Uninitialized scalar field
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 multiple ctor's strikes again
 Change-Id: Ieaae6d5c9e76a3ade17289ce7d1bdffad1168cc9
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/91191
 Tested-by: Jenkins
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 698ecd52e4ca14b5ce633a3358a95992b0dd638c)
 ---
 dbaccess/source/core/dataaccess/ModelImpl.cxx | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx b/dbaccess/source/core/dataaccess/ModelImpl.cxx
 index d5c3b9b3e086..1f11f3679289 100644
 --- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
 +++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
@@ -407,6 +407,7 @@ ODatabaseModelImpl::ODatabaseModelImpl(
             ,m_aEmbeddedMacros()
             ,m_bModificationLock( false )
             ,m_bDocumentInitialized( false )
 +            ,m_nScriptingSignatureState(SignatureState::UNKNOWN)
             ,m_aContext( _rxContext )
             ,m_sName(_rRegistrationName)
             ,m_nLoginTimeout(0)
 -- 
 2.28.0
--- a/SOURCES/0005-rhbz-1618703-Allow-to-use-OpenSSL-as-backend-for-rtl.patch
+++ b/SOURCES/0005-rhbz-1618703-Allow-to-use-OpenSSL-as-backend-for-rtl.patch
@ -1,684 +0,0 @@
 From cb0fdfa1d2d98880839dda8114b0af7c4254bc86 Mon Sep 17 00:00:00 2001
 From: Stephan Bergmann <sbergman@redhat.com>
 Date: Wed, 22 Aug 2018 09:49:25 +0200
 Subject: [PATCH 5/5] rhbz#1618703: Allow to use OpenSSL as backend for
 rtl/cipher.h
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 ...with new configuration option --enable-cipher-openssl-backend
 rtl/cipher.h (which is part of the stable URE interface) offers functionality to
 en-/decrypt data with Blowfish in ECB, CBC, and streaming CFB mode, and with RC4
 (aka ARCFOUR; which is a stream cipher).  LO itself only uses Blowfish CFB and
 RC4, so only those are wired to OpenSSL for now, for simplicity.  Using Blowfish
 ECB and CBC, or Blowfish CFB in DirectionBoth mode would cause failures for now
 (cf. sal/qa/rtl/cipher/rtl_cipher.cxx); the assumption is that no external code
 actually makes use of this functionality.
 Using NSS instead of OpenSSL could be an alternative, but there appears to be no
 support in NSS for Blowfish in streaming CFB mode, only CKM_BLOWFISH_CBC for
 CBC mode.
 Reviewed-on: https://gerrit.libreoffice.org/59428
 Tested-by: Jenkins
 Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
 (cherry picked from commit 4bc16aeb73c1201f187742e0fefe35521fae77ac)
 Reviewed-on: https://gerrit.libreoffice.org/59575
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 Tested-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 062ac27d7052bcdf0bdd5db978e041d4c614fd6b)
 Conflicts:
 	sal/rtl/cipher.cxx
 Change-Id: I0bc042961539ed46844c96cb1c808209578528a0
 ---
 config_host.mk.in                |   1 +
 configure.ac                     |  23 +++++
 sal/CppunitTest_sal_rtl.mk       |   4 +
 sal/Library_sal.mk               |   8 ++
 sal/qa/rtl/cipher/rtl_cipher.cxx |  61 +++++++++++
 sal/rtl/cipher.cxx               | 167 ++++++++++++++++++++++++++++++-
 6 files changed, 260 insertions(+), 4 deletions(-)
 diff --git a/config_host.mk.in b/config_host.mk.in
 index 8cbbc5fee1d5..e683a5ac883c 100644
 --- a/config_host.mk.in
 +++ b/config_host.mk.in
@@ -109,6 +109,7 @@ export ENABLE_AVAHI=@ENABLE_AVAHI@
 export ENABLE_BREAKPAD=@ENABLE_BREAKPAD@
 export ENABLE_CAIRO_CANVAS=@ENABLE_CAIRO_CANVAS@
 export ENABLE_CHART_TESTS=@ENABLE_CHART_TESTS@
 +export ENABLE_CIPHER_OPENSSL_BACKEND=@ENABLE_CIPHER_OPENSSL_BACKEND@
 export ENABLE_LIBCMIS=@ENABLE_LIBCMIS@
 export ENABLE_COINMP=@ENABLE_COINMP@
 export SYSTEM_COINMP=@SYSTEM_COINMP@
 diff --git a/configure.ac b/configure.ac
 index 938d20571242..70890733a2a8 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -1392,6 +1392,11 @@ AC_ARG_ENABLE(openssl,
          use only if you are hacking on it.]),
 ,enable_openssl=yes)
 +libo_FUZZ_ARG_ENABLE(cipher-openssl-backend,
 +    AS_HELP_STRING([--enable-cipher-openssl-backend],
 +        [Enable using OpenSSL as the actual implementation of the rtl/cipher.h functionality.
 +         Requires --enable-openssl.]))
 +
 AC_ARG_ENABLE(library-bin-tar,
     AS_HELP_STRING([--enable-library-bin-tar],
         [Enable the building and reused of tarball of binary build for some 'external' libraries.
@@ -9240,6 +9245,24 @@ fi
 AC_SUBST([DISABLE_OPENSSL])
 +if test "$enable_cipher_openssl_backend" = yes && test "$DISABLE_OPENSSL" = TRUE; then
 +    if test "$libo_fuzzed_enable_cipher_openssl_backend" = yes; then
 +        AC_MSG_NOTICE([Resetting --enable-cipher-openssl-backend=no])
 +        enable_cipher_openssl_backend=no
 +    else
 +        AC_MSG_ERROR([--enable-cipher-openssl-backend needs OpenSSL, but --disable-openssl was given.])
 +    fi
 +fi
 +AC_MSG_CHECKING([whether to enable the OpenSSL backend for rtl/cipher.h])
 +ENABLE_CIPHER_OPENSSL_BACKEND=
 +if test "$enable_cipher_openssl_backend" = yes; then
 +    AC_MSG_RESULT([yes])
 +    ENABLE_CIPHER_OPENSSL_BACKEND=TRUE
 +else
 +    AC_MSG_RESULT([no])
 +fi
 +AC_SUBST([ENABLE_CIPHER_OPENSSL_BACKEND])
 +
 dnl ===================================================================
 dnl Check for building gnutls
 dnl ===================================================================
 diff --git a/sal/CppunitTest_sal_rtl.mk b/sal/CppunitTest_sal_rtl.mk
 index 43533fc5ab1c..c2eaa72daa26 100644
 --- a/sal/CppunitTest_sal_rtl.mk
 +++ b/sal/CppunitTest_sal_rtl.mk
@@ -63,4 +63,8 @@ $(call gb_CppunitTest_get_target,sal_rtl) : \
 $(eval $(call gb_CppunitTest_use_external,sal_rtl,boost_headers))
 +ifeq ($(ENABLE_CIPHER_OPENSSL_BACKEND),TRUE)
 +$(eval $(call gb_CppunitTest_add_defs,sal_rtl,-DLIBO_CIPHER_OPENSSL_BACKEND))
 +endif
 +
 # vim: set noet sw=4 ts=4:
 diff --git a/sal/Library_sal.mk b/sal/Library_sal.mk
 index 17d89ae79e4a..bce0437a19bf 100644
 --- a/sal/Library_sal.mk
 +++ b/sal/Library_sal.mk
@@ -255,4 +255,12 @@ $(eval $(call gb_Library_add_exception_objects,sal,\
 endif # ifneq ($(OS),WNT)
 +ifeq ($(ENABLE_CIPHER_OPENSSL_BACKEND),TRUE)
 +$(eval $(call gb_Library_add_defs,sal,-DLIBO_CIPHER_OPENSSL_BACKEND))
 +$(eval $(call gb_Library_use_externals,sal, \
 +    openssl \
 +    openssl_headers \
 +))
 +endif
 +
 # vim: set noet sw=4 ts=4:
 diff --git a/sal/qa/rtl/cipher/rtl_cipher.cxx b/sal/qa/rtl/cipher/rtl_cipher.cxx
 index e8877a92c5d5..57c22eb573ac 100644
 --- a/sal/qa/rtl/cipher/rtl_cipher.cxx
 +++ b/sal/qa/rtl/cipher/rtl_cipher.cxx
@@ -37,8 +37,12 @@ public:
     void create_001()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void create_002()
         {
@@ -48,8 +52,12 @@ public:
     void create_003()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeCBC);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void create_004()
         {
@@ -101,14 +109,22 @@ public:
     void createBF_001()
         {
             rtlCipher aCipher = rtl_cipher_createBF(rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void createBF_002()
         {
             rtlCipher aCipher = rtl_cipher_createBF(rtl_Cipher_ModeCBC);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void createBF_003()
         {
@@ -141,6 +157,12 @@ public:
     void test_encode(sal_uInt8 _nKeyValue, sal_uInt8 _nArgValue, rtl::OString const& _sPlainTextStr)
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +            (void) _nKeyValue;
 +            (void) _nArgValue;
 +            (void) _sPlainTextStr;
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -184,11 +206,18 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void test_encode_and_decode(sal_uInt8 _nKeyValue, sal_uInt8 _nArgValue, rtl::OString const& _sPlainTextStr)
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +            (void) _nKeyValue;
 +            (void) _nArgValue;
 +            (void) _sPlainTextStr;
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -236,6 +265,7 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void decode_001()
@@ -286,8 +316,12 @@ public:
     void destroy_001()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeCBC);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     // Change the following lines only, if you add, remove or rename
     // member functions of the current class,
@@ -305,10 +339,14 @@ public:
     void destroyBF_001()
         {
             rtlCipher aCipher = rtl_cipher_createBF(rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             rtl_cipher_destroyBF(aCipher);
             // more proforma
             // should not GPF
 +#endif
         }
     // Change the following lines only, if you add, remove or rename
     // member functions of the current class,
@@ -326,6 +364,12 @@ public:
     void test_encode(sal_uInt8 _nKeyValue, sal_uInt8 _nArgValue, sal_uInt8 _nDataValue)
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +            (void) _nKeyValue;
 +            (void) _nArgValue;
 +            (void) _nDataValue;
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -360,6 +404,7 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void encode_001()
@@ -407,6 +452,9 @@ public:
     void init_001()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -424,11 +472,15 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void init_002()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -447,10 +499,14 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void init_003()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -469,10 +525,14 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     void init_004()
         {
             rtlCipher aCipher = rtl_cipher_create(rtl_Cipher_AlgorithmBF, rtl_Cipher_ModeECB);
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            CPPUNIT_ASSERT_EQUAL(rtlCipher(nullptr), aCipher);
 +#else
             CPPUNIT_ASSERT_MESSAGE("create failed.", aCipher != nullptr);
             sal_uInt32     nKeyLen = 16;
@@ -492,6 +552,7 @@ public:
             delete [] pKeyBuffer;
             rtl_cipher_destroy(aCipher);
 +#endif
         }
     // Change the following lines only, if you add, remove or rename
     // member functions of the current class,
 diff --git a/sal/rtl/cipher.cxx b/sal/rtl/cipher.cxx
 index 80e096f5a3a1..9dd649848eff 100644
 --- a/sal/rtl/cipher.cxx
 +++ b/sal/rtl/cipher.cxx
@@ -22,7 +22,16 @@
 #include <sal/types.h>
 #include <rtl/alloc.h>
 #include <rtl/cipher.h>
 +#include <algorithm>
 +#include <cassert>
 +#include <cstring>
 +#include <limits>
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +#include <openssl/evp.h>
 +#endif
 +
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 #define RTL_CIPHER_NTOHL(c, l) \
     ((l)  = ((sal_uInt32)(*((c)++))) << 24, \
      (l) |= ((sal_uInt32)(*((c)++))) << 16, \
@@ -81,6 +90,7 @@
         case 1: *(--(c)) = (sal_uInt8)(((xl) >> 24) & 0xff); \
     } \
 }
 +#endif
 typedef rtlCipherError(SAL_CALL cipher_init_t) (
     rtlCipher          Cipher,
@@ -182,6 +192,7 @@ void SAL_CALL rtl_cipher_destroy(rtlCipher Cipher) SAL_THROW_EXTERN_C()
         pImpl->m_delete(Cipher);
 }
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 #define CIPHER_ROUNDS_BF 16
 struct CipherKeyBF
@@ -189,9 +200,13 @@ struct CipherKeyBF
     sal_uInt32 m_S[4][256];
     sal_uInt32 m_P[CIPHER_ROUNDS_BF + 2];
 };
 +#endif
 struct CipherContextBF
 {
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    EVP_CIPHER_CTX * m_context;
 +#else
     CipherKeyBF    m_key;
     union
     {
@@ -199,6 +214,7 @@ struct CipherContextBF
         sal_uInt8  m_byte[8];
     } m_iv;
     sal_uInt32     m_offset;
 +#endif
 };
 struct CipherBF_Impl
@@ -207,11 +223,13 @@ struct CipherBF_Impl
     CipherContextBF m_context;
 };
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 static rtlCipherError BF_init(
     CipherContextBF *ctx,
     rtlCipherMode    eMode,
     const sal_uInt8 *pKeyData, sal_Size nKeyLen,
     const sal_uInt8 *pArgData, sal_Size nArgLen);
 +#endif
 static rtlCipherError BF_update(
     CipherContextBF    *ctx,
@@ -220,6 +238,7 @@ static rtlCipherError BF_update(
     const sal_uInt8    *pData,   sal_Size nDatLen,
     sal_uInt8          *pBuffer, sal_Size nBufLen);
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 static void BF_updateECB(
     CipherContextBF    *ctx,
     rtlCipherDirection  direction,
@@ -608,7 +627,9 @@ static const CipherKeyBF BF_key =
         0x9216D5D9L, 0x8979FB1BL
     }
 };
 +#endif
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 static rtlCipherError BF_init(
     CipherContextBF *ctx,
     rtlCipherMode    eMode,
@@ -675,6 +696,7 @@ static rtlCipherError BF_init(
     return rtl_Cipher_E_None;
 }
 +#endif
 static rtlCipherError BF_update(
     CipherContextBF    *ctx,
@@ -691,6 +713,31 @@ static rtlCipherError BF_update(
         return rtl_Cipher_E_BufferSize;
     /* Update. */
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    assert(eMode == rtl_Cipher_ModeStream);
 +    (void) eDirection;
 +    while (nDatLen > std::numeric_limits<int>::max()) {
 +        int outl;
 +        if (EVP_CipherUpdate(ctx->m_context, pBuffer, &outl, pData, std::numeric_limits<int>::max())
 +            == 0)
 +        {
 +            return rtl_Cipher_E_Unknown;
 +        }
 +        assert(outl == std::numeric_limits<int>::max());
 +        pData += std::numeric_limits<int>::max();
 +        nDatLen -= std::numeric_limits<int>::max();
 +        pBuffer += std::numeric_limits<int>::max();
 +    }
 +    int outl;
 +    if (EVP_CipherUpdate(ctx->m_context, pBuffer, &outl, pData, static_cast<int>(nDatLen)) == 0)
 +    {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    assert(outl == static_cast<int>(nDatLen));
 +    // A final call to EVP_CipherFinal_ex is intentionally missing; it wouldn't fit the rtl/cipher.h
 +    // interface, and is hopefully not needed, as each individual Blowfish CFB update step doesn't
 +    // hold back any data that would need to be finally flushed.
 +#else
     if (eMode == rtl_Cipher_ModeECB)
     {
         /* Block mode. */
@@ -726,9 +773,11 @@ static rtlCipherError BF_update(
             pBuffer += 1;
         }
     }
 +#endif
     return rtl_Cipher_E_None;
 }
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 static void BF_updateECB(
     CipherContextBF    *ctx,
     rtlCipherDirection  direction,
@@ -931,6 +980,7 @@ static sal_uInt32 BF(CipherKeyBF *key, sal_uInt32 x)
     return y;
 }
 +#endif
 /**
     rtl_cipherBF (Blowfish) implementation.
@@ -943,6 +993,12 @@ rtlCipher SAL_CALL rtl_cipher_createBF(rtlCipherMode Mode) SAL_THROW_EXTERN_C()
     if (Mode == rtl_Cipher_ModeInvalid)
         return nullptr;
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    if (Mode != rtl_Cipher_ModeStream) {
 +        // Cannot easily support ModeECB and ModeCBC, and they aren't used in the LO code at least:
 +        return nullptr;
 +    }
 +#endif
     pImpl = static_cast<CipherBF_Impl*>(rtl_allocateZeroMemory(sizeof (CipherBF_Impl)));
     if (pImpl)
@@ -978,9 +1034,45 @@ rtlCipherError SAL_CALL rtl_cipher_initBF(
     else
         return rtl_Cipher_E_Direction;
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    if (pImpl->m_cipher.m_direction == rtl_Cipher_DirectionBoth) {
 +        // Cannot easily support DirectionBoth, and it isn't used in the LO code at least:
 +        return rtl_Cipher_E_Direction;
 +    }
 +    if (nKeyLen > std::numeric_limits<int>::max()) {
 +        return rtl_Cipher_E_BufferSize;
 +    }
 +    if (pImpl->m_context.m_context != nullptr) {
 +        EVP_CIPHER_CTX_free(pImpl->m_context.m_context);
 +    }
 +    pImpl->m_context.m_context = EVP_CIPHER_CTX_new();
 +    if (pImpl->m_context.m_context == nullptr) {
 +        return rtl_Cipher_E_Memory;
 +    }
 +    unsigned char iv[8];
 +    auto const n = std::min(nArgLen, sal_Size(8));
 +    std::memcpy(iv, pArgData, n);
 +    std::memset(iv + n, 0, 8 - n);
 +    if (EVP_CipherInit_ex(
 +            pImpl->m_context.m_context, EVP_bf_cfb(), nullptr, nullptr, iv,
 +            pImpl->m_cipher.m_direction == rtl_Cipher_DirectionDecode ? 0 : 1)
 +        == 0)
 +    {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    if (EVP_CIPHER_CTX_set_key_length(pImpl->m_context.m_context, static_cast<int>(nKeyLen)) == 0) {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    if (EVP_CipherInit_ex(pImpl->m_context.m_context, nullptr, nullptr, pKeyData, nullptr, -1) == 0)
 +    {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    return rtl_Cipher_E_None;
 +#else
     return BF_init(
         &(pImpl->m_context), pImpl->m_cipher.m_mode,
         pKeyData, nKeyLen, pArgData, nArgLen);
 +#endif
 }
 rtlCipherError SAL_CALL rtl_cipher_encodeBF(
@@ -1037,18 +1129,31 @@ void SAL_CALL rtl_cipher_destroyBF(rtlCipher Cipher) SAL_THROW_EXTERN_C()
     if (pImpl)
     {
         if (pImpl->m_cipher.m_algorithm == rtl_Cipher_AlgorithmBF)
 +        {
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            if (pImpl->m_context.m_context != nullptr) {
 +                EVP_CIPHER_CTX_free(pImpl->m_context.m_context);
 +            }
 +#endif
             rtl_freeZeroMemory(pImpl, sizeof(CipherBF_Impl));
 +        }
         else
             rtl_freeMemory(pImpl);
     }
 }
 +#if !defined LIBO_CIPHER_OPENSSL_BACKEND
 #define CIPHER_CBLOCK_ARCFOUR 256
 +#endif
 struct ContextARCFOUR_Impl
 {
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    EVP_CIPHER_CTX * m_context;
 +#else
     unsigned int m_S[CIPHER_CBLOCK_ARCFOUR];
     unsigned int m_X, m_Y;
 +#endif
 };
 struct CipherARCFOUR_Impl
@@ -1066,6 +1171,29 @@ static rtlCipherError rtl_cipherARCFOUR_init_Impl(
     ContextARCFOUR_Impl *ctx,
     const sal_uInt8     *pKeyData, sal_Size nKeyLen)
 {
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    if (nKeyLen > std::numeric_limits<int>::max()) {
 +        return rtl_Cipher_E_BufferSize;
 +    }
 +    if (ctx->m_context != nullptr) {
 +        EVP_CIPHER_CTX_free(ctx->m_context);
 +    }
 +    ctx->m_context = EVP_CIPHER_CTX_new();
 +    if (ctx->m_context == nullptr) {
 +        return rtl_Cipher_E_Memory;
 +    }
 +    if (EVP_CipherInit_ex(ctx->m_context, EVP_rc4(), nullptr, nullptr, nullptr, 0) == 0) {
 +            // RC4 en- and decryption is identical, so we can use 0=decrypt regardless of direction,
 +            // and thus also support rtl_Cipher_DirectionBoth
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    if (EVP_CIPHER_CTX_set_key_length(ctx->m_context, static_cast<int>(nKeyLen)) == 0) {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    if (EVP_CipherInit_ex(ctx->m_context, nullptr, nullptr, pKeyData, nullptr, -1) == 0) {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +#else
     unsigned int  K[CIPHER_CBLOCK_ARCFOUR];
     unsigned int *L, *S;
     unsigned int  x, y, t;
@@ -1106,6 +1234,7 @@ static rtlCipherError rtl_cipherARCFOUR_init_Impl(
     /* Initialize counters X and Y. */
     ctx->m_X = 0;
     ctx->m_Y = 0;
 +#endif
     return rtl_Cipher_E_None;
 }
@@ -1115,10 +1244,6 @@ static rtlCipherError rtl_cipherARCFOUR_update_Impl(
     const sal_uInt8     *pData,   sal_Size nDatLen,
     sal_uInt8           *pBuffer, sal_Size nBufLen)
 {
 -    unsigned int *S;
 -    unsigned int t;
 -    sal_Size k;
 -
     /* Check arguments. */
     if (!pData || !pBuffer)
         return rtl_Cipher_E_Argument;
@@ -1126,6 +1251,32 @@ static rtlCipherError rtl_cipherARCFOUR_update_Impl(
     if (!((0 < nDatLen) && (nDatLen <= nBufLen)))
         return rtl_Cipher_E_BufferSize;
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +    while (nDatLen > std::numeric_limits<int>::max()) {
 +        int outl;
 +        if (EVP_CipherUpdate(ctx->m_context, pBuffer, &outl, pData, std::numeric_limits<int>::max())
 +            == 0)
 +        {
 +            return rtl_Cipher_E_Unknown;
 +        }
 +        assert(outl == std::numeric_limits<int>::max());
 +        pData += std::numeric_limits<int>::max();
 +        nDatLen -= std::numeric_limits<int>::max();
 +        pBuffer += std::numeric_limits<int>::max();
 +    }
 +    int outl;
 +    if (EVP_CipherUpdate(ctx->m_context, pBuffer, &outl, pData, static_cast<int>(nDatLen)) == 0) {
 +        return rtl_Cipher_E_Unknown;
 +    }
 +    assert(outl == static_cast<int>(nDatLen));
 +    // A final call to EVP_CipherFinal_ex is intentionally missing; it wouldn't fit the rtl/cipher.h
 +    // interface, and is hopefully not needed, as each individual RC4 update step doesn't hold back
 +    // any data that would need to be finally flushed.
 +#else
 +    unsigned int *S;
 +    unsigned int t;
 +    sal_Size k;
 +
     /* Update. */
     S = &(ctx->m_S[0]);
     for (k = 0; k < nDatLen; k++)
@@ -1147,6 +1298,7 @@ static rtlCipherError rtl_cipherARCFOUR_update_Impl(
         t = (S[x] + S[y]) % CIPHER_CBLOCK_ARCFOUR;
         pBuffer[k] = pData[k] ^ ((sal_uInt8)(S[t] & 0xff));
     }
 +#endif
     return rtl_Cipher_E_None;
 }
@@ -1249,7 +1401,14 @@ void SAL_CALL rtl_cipher_destroyARCFOUR(rtlCipher Cipher) SAL_THROW_EXTERN_C()
     if (pImpl)
     {
         if (pImpl->m_cipher.m_algorithm == rtl_Cipher_AlgorithmARCFOUR)
 +        {
 +#if defined LIBO_CIPHER_OPENSSL_BACKEND
 +            if (pImpl->m_context.m_context != nullptr) {
 +                EVP_CIPHER_CTX_free(pImpl->m_context.m_context);
 +            }
 +#endif
             rtl_freeZeroMemory(pImpl, sizeof(CipherARCFOUR_Impl));
 +        }
         else
             rtl_freeMemory(pImpl);
     }
 -- 
 2.17.1
--- a/SOURCES/0006-CVE-2023-6186-backporting.patch
+++ b/SOURCES/0006-CVE-2023-6186-backporting.patch
@ -0,0 +1,65 @@
 From a255a9c69d35df27e92349ea5bb9cb8d6c46d97f Mon Sep 17 00:00:00 2001
 From: rpmbuild <rpmbuild@fedoraproject.org>
 Date: Fri, 8 Mar 2024 17:51:24 +0100
 Subject: [PATCH] CVE-2023-6186 backporting
 Add dialog text string STR_DANGEROUS_TO_OPEN
 as per upstream commit 70009098fd70df021048c540d1796c928554b494
 SfxViewFrame doesn't have GetFrameWeld() yet, get from Window.
 ---
 include/sfx2/strings.hrc          | 1 +
 sc/source/core/data/global.cxx    | 4 +++-
 sw/source/uibase/wrtsh/wrtsh2.cxx | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)
 diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
 index 1db36e7..29950ba 100644
 --- a/include/sfx2/strings.hrc
 +++ b/include/sfx2/strings.hrc
@@ -103,6 +103,7 @@
 #define STR_GB                                  NC_("STR_GB", "GB")
 #define STR_QUERY_LASTVERSION                   NC_("STR_QUERY_LASTVERSION", "Cancel all changes?")
 #define STR_NO_WEBBROWSER_FOUND                 NC_("STR_NO_WEBBROWSER_FOUND", "Opening \"$(ARG1)\" failed with error code $(ARG2) and message: \"$(ARG3)\"\nMaybe no web browser could be found on your system. In that case, please check your Desktop Preferences or install a web browser (for example, Firefox) in the default location requested during the browser installation.")
 +#define STR_DANGEROUS_TO_OPEN                   NC_("STR_DANGEROUS_TO_OPEN", "It might be dangerous to open \"$(ARG1)\".\nDo you really want to open it?")
 #define STR_NO_ABS_URI_REF                      NC_("STR_NO_ABS_URI_REF", "\"$(ARG1)\" is not an absolute URL that can be passed to an external application to open it.")
 #define STR_GID_INTERN                          NC_("STR_GID_INTERN", "Internal")
 #define STR_GID_APPLICATION                     NC_("STR_GID_APPLICATION", "Application")
 diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
 index b16be6b..3295a38 100644
 --- a/sc/source/core/data/global.cxx
 +++ b/sc/source/core/data/global.cxx
@@ -37,6 +37,8 @@
 #include <vcl/virdev.hxx>
 #include <vcl/settings.hxx>
 #include <vcl/svapp.hxx>
 +#include <vcl/weld.hxx>
 +#include <vcl/window.hxx>
 #include <unotools/charclass.hxx>
 #include <unotools/securityoptions.hxx>
 #include <osl/diagnose.h>
@@ -823,7 +825,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
             aUrlName = aNewUrlName;
     }
 -    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetFrameWeld() : nullptr))
 +    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetWindow().GetFrameWeld() : nullptr))
         return;
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
 diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx
 index 41f427a..543644d 100644
 --- a/sw/source/uibase/wrtsh/wrtsh2.cxx
 +++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
@@ -495,7 +495,7 @@ static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
     OSL_ENSURE( pDShell, "No DocShell?!");
     SfxViewFrame* pViewFrame = rView.GetViewFrame();
 -    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetFrameWeld()))
 +    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetWindow().GetFrameWeld()))
         return;
     // We are doing tiledRendering, let the client handles the URL loading,
 -- 
 2.43.0
--- a/SOURCES/0006-tdf-137897-scRetypePassInputDlg-re-allow-password-re.patch
+++ b/SOURCES/0006-tdf-137897-scRetypePassInputDlg-re-allow-password-re.patch
@ -0,0 +1,45 @@
 From 81618bd69088436eb60fd07b944effb178d788ae Mon Sep 17 00:00:00 2001
 From: Justin Luth <justin.luth@collabora.com>
 Date: Sat, 31 Oct 2020 15:36:44 +0300
 Subject: [PATCH 6/8] tdf#137897 scRetypePassInputDlg: re-allow password
 removal
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This weld-conversion logic error caused a LO 6.1 regression
 in commit 0e4f93e88bfae3489d2de84fc2febed100880628.
 -   m_pPasswordGrid->Disable();
 +   m_xPasswordGrid->set_sensitive(false);  //disable == false
 -   m_pBtnOk->Enable();
 +   m_xBtnOk->set_sensitive(false);         //enable == true
 The result is that attempting to remove the password did not
 enable the OK button, so it was impossible.
 Change-Id: I4067b2ec6b89e86b21968d33c8850cca6d067e71
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105049
 Tested-by: Jenkins
 Reviewed-by: Caolán McNamara <caolanm@redhat.com>
 (cherry picked from commit 9eeaff5fa9070bea685db8b6bbd2dfc1565756ac)
 ---
 sc/source/ui/miscdlgs/retypepassdlg.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/sc/source/ui/miscdlgs/retypepassdlg.cxx b/sc/source/ui/miscdlgs/retypepassdlg.cxx
 index 84f8ef182b54..fa31ea77e392 100644
 --- a/sc/source/ui/miscdlgs/retypepassdlg.cxx
 +++ b/sc/source/ui/miscdlgs/retypepassdlg.cxx
@@ -372,7 +372,7 @@ IMPL_LINK_NOARG(ScRetypePassInputDlg, RadioBtnHdl, weld::ToggleButton&, void)
     else
     {
         m_xPasswordGrid->set_sensitive(false);
 -        m_xBtnOk->set_sensitive(false);
 +        m_xBtnOk->set_sensitive(true);
     }
 }
 -- 
 2.28.0
--- a/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
+++ b/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
--- a/SOURCES/0007-tdf-137982-m_xFrame-is-already-disposed.patch
+++ b/SOURCES/0007-tdf-137982-m_xFrame-is-already-disposed.patch
@ -0,0 +1,137 @@
 From 7efe51c401ee469ae4835994e5f11b158fd354b9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Wed, 4 Nov 2020 13:01:53 +0000
 Subject: [PATCH 7/8] tdf#137982 m_xFrame is already disposed
 move the frame cleanup into a helper that listens to see if it got
 disposed by the preview itself
 Change-Id: I523285268118300f18b0f0f0a10fab7a9cced9c6
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105221
 Tested-by: Jenkins
 Reviewed-by: Michael Stahl <michael.stahl@cib.de>
 (cherry picked from commit a986db4b2d24669e502e447036851e118cc23036)
 ---
 sw/source/ui/dbui/dbtablepreviewdialog.cxx | 53 ++++++++++++++++++----
 sw/source/ui/dbui/dbtablepreviewdialog.hxx |  4 +-
 2 files changed, 46 insertions(+), 11 deletions(-)
 diff --git a/sw/source/ui/dbui/dbtablepreviewdialog.cxx b/sw/source/ui/dbui/dbtablepreviewdialog.cxx
 index 23e7984623d8..8f2d92b1c7d5 100644
 --- a/sw/source/ui/dbui/dbtablepreviewdialog.cxx
 +++ b/sw/source/ui/dbui/dbtablepreviewdialog.cxx
@@ -20,6 +20,8 @@
 #include <swtypes.hxx>
 #include "dbtablepreviewdialog.hxx"
 #include <comphelper/processfactory.hxx>
 +#include <cppuhelper/implbase.hxx>
 +#include <com/sun/star/document/XEventListener.hpp>
 #include <com/sun/star/frame/Frame.hpp>
 #include <toolkit/helper/vclunohelper.hxx>
@@ -32,6 +34,34 @@ using namespace ::com::sun::star::beans;
 using namespace ::com::sun::star::lang;
 using namespace ::com::sun::star::util;
 +class DBTablePreviewFrame
 +    : public cppu::WeakImplHelper<lang::XEventListener>
 +{
 +private:
 +    css::uno::Reference<css::frame::XFrame2> m_xFrame;
 +
 +    virtual void SAL_CALL disposing(const lang::EventObject& /*Source*/) override
 +    {
 +        m_xFrame.clear();
 +    }
 +
 +public:
 +    DBTablePreviewFrame(css::uno::Reference<css::frame::XFrame2>& rFrame)
 +        : m_xFrame(rFrame)
 +    {
 +    }
 +
 +    void cleanup()
 +    {
 +        if (m_xFrame.is())
 +        {
 +            m_xFrame->setComponent(nullptr, nullptr);
 +            m_xFrame->dispose();
 +            m_xFrame.clear();
 +        }
 +    }
 +};
 +
 SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Sequence< beans::PropertyValue> const & rValues)
     : SfxDialogController(pParent, "modules/swriter/ui/tablepreviewdialog.ui", "TablePreviewDialog")
     , m_xDescriptionFI(m_xBuilder->weld_label("description"))
@@ -51,22 +81,26 @@ SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Seque
         m_xDescriptionFI->set_label(sDescription.replaceFirst("%1", sTemp));
     }
 +    css::uno::Reference<css::frame::XFrame2> xFrame;
     try
     {
         // create a frame wrapper for myself
 -        m_xFrame = frame::Frame::create( comphelper::getProcessComponentContext() );
 -        m_xFrame->initialize(m_xBeamerWIN->CreateChildFrame());
 +        xFrame = frame::Frame::create( comphelper::getProcessComponentContext() );
 +        xFrame->initialize(m_xBeamerWIN->CreateChildFrame());
     }
     catch (uno::Exception const &)
     {
 -        m_xFrame.clear();
 +        xFrame.clear();
     }
 -    if (m_xFrame.is())
 +    if (xFrame.is())
     {
 +        m_xFrameListener.set(new DBTablePreviewFrame(xFrame));
 +        xFrame->addEventListener(m_xFrameListener.get());
 +
         util::URL aURL;
         aURL.Complete = ".component:DB/DataSourceBrowser";
 -        uno::Reference<frame::XDispatch> xD = m_xFrame->queryDispatch(aURL, "", 0x0C);
 -        if(xD.is())
 +        uno::Reference<frame::XDispatch> xD = xFrame->queryDispatch(aURL, "", 0x0C);
 +        if (xD.is())
         {
             xD->dispatch(aURL, rValues);
             m_xBeamerWIN->show();
@@ -76,11 +110,10 @@ SwDBTablePreviewDialog::SwDBTablePreviewDialog(weld::Window* pParent, uno::Seque
 SwDBTablePreviewDialog::~SwDBTablePreviewDialog()
 {
 -    if(m_xFrame.is())
 +    if (m_xFrameListener)
     {
 -        m_xFrame->setComponent(nullptr, nullptr);
 -        m_xFrame->dispose();
 -        m_xFrame.clear();
 +        m_xFrameListener->cleanup();
 +        m_xFrameListener.clear();
     }
 }
 diff --git a/sw/source/ui/dbui/dbtablepreviewdialog.hxx b/sw/source/ui/dbui/dbtablepreviewdialog.hxx
 index ec2c58d92bf3..27e6e83d39ca 100644
 --- a/sw/source/ui/dbui/dbtablepreviewdialog.hxx
 +++ b/sw/source/ui/dbui/dbtablepreviewdialog.hxx
@@ -27,12 +27,14 @@ namespace com{ namespace sun{ namespace star{
     namespace frame{ class XFrame2;     }
     }}}
 +class DBTablePreviewFrame;
 +
 class SwDBTablePreviewDialog : public SfxDialogController
 {
     std::unique_ptr<weld::Label> m_xDescriptionFI;
     std::unique_ptr<weld::Container> m_xBeamerWIN;
 -    css::uno::Reference< css::frame::XFrame2 >         m_xFrame;
 +    rtl::Reference<DBTablePreviewFrame> m_xFrameListener;
 public:
     SwDBTablePreviewDialog(weld::Window* pParent,
             css::uno::Sequence< css::beans::PropertyValue> const & rValues  );
 -- 
 2.28.0
--- a/SOURCES/0008-Resolves-tdf-137215-restore-original-modality-before.patch
+++ b/SOURCES/0008-Resolves-tdf-137215-restore-original-modality-before.patch
@ -0,0 +1,52 @@
 From fa0371ce0456bfe355c36df0741ff23daeccb3a3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
 Date: Tue, 3 Nov 2020 14:04:37 +0000
 Subject: [PATCH 8/8] Resolves: tdf#137215 restore original modality before
 dialog loop ends
 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105214
 Tested-by: Jenkins
 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
 (cherry picked from commit 022c11602d2101b49724b5cf104cc6c70b5a5e4b)
 Change-Id: I83467e28534b781c51b8d75a023e41f3c6a03903
 ---
 sc/source/ui/dbgui/validate.cxx | 8 ++++++++
 sc/source/ui/inc/validate.hxx   | 2 ++
 2 files changed, 10 insertions(+)
 diff --git a/sc/source/ui/dbgui/validate.cxx b/sc/source/ui/dbgui/validate.cxx
 index 41bc913db911..73e04cc44706 100644
 --- a/sc/source/ui/dbgui/validate.cxx
 +++ b/sc/source/ui/dbgui/validate.cxx
@@ -95,6 +95,14 @@ ScValidationDlg::ScValidationDlg(weld::Window* pParent, const SfxItemSet* pArgSe
     AddTabPage("erroralert", ScTPValidationError::Create, nullptr);
 }
 +void ScValidationDlg::EndDialog()
 +{
 +    // tdf#137215 ensure original modalality of true is restored before dialog loop ends
 +    if (m_bOwnRefHdlr)
 +        RemoveRefDlg(true);
 +    ScValidationDlgBase::EndDialog();
 +}
 +
 ScValidationDlg::~ScValidationDlg()
 {
     if (m_bOwnRefHdlr)
 diff --git a/sc/source/ui/inc/validate.hxx b/sc/source/ui/inc/validate.hxx
 index 2c562717f921..cb88b9e8b40e 100644
 --- a/sc/source/ui/inc/validate.hxx
 +++ b/sc/source/ui/inc/validate.hxx
@@ -176,6 +176,8 @@ public:
     void            SetModal(bool bModal) { m_xDialog->set_modal(bModal); }
 +    virtual void EndDialog() override;
 +
     virtual void            SetReference( const ScRange& rRef, ScDocument* pDoc ) override
     {
         if ( m_pHandler && m_pSetReferenceHdl )
 -- 
 2.28.0
--- a/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+++ b/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
@ -0,0 +1,51 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 mQINBEyzEr0BEADT441wUITsTwDA2nM3kmUhGrzTdxZB5xv/E1ZJCw63qWdmdTdW
 NZDfNDuLs4r2VjlEoA3xGK6jgnQvyAoNj0yiEbW/JedHHgOiVdXDlkgkY58myafT
 FXqDLzTXVrsNnay0GS8XrNjptZJPhEPBvNUdkqpA9B7RTkfaXj779Pf/AeFMZVLl
 UAci5RA0NNF910GHwoXT6SEv2PGoawsphnfmMVdKh9wz7asbtKXEmotCwX3k045x
 LsIVK5ANOi+BI9C3LkrrFJWw2XHqDW2ulwCJ0L5QNSjOuY/v8REODwIXamvvdZOz
 XBKSIzDOalJqFCHls3YlGyFw1knr6BAOmVOm32YtNTCLbVA/iK55fZWnUCjD3a4G
 xz4qpQYWfpxhOmlHpk5JkraSNHzCc7SB43DwcHF5ecXHttMhO8MoN/bAZBgCuLGF
 EwNvwFbDwIWo07mlv7wD8i1rtUCvLywJc5YL2PbjCLfB1Q4YzDX1EWnjKdnAsxxK
 ftrx1DFlxzUF+TaHbLTPttUcsWQaL8wITznoWIwdIWlo2woPgWIpUXMOYwYV31Oo
 fgmroHa3V4NOvkke09uhaZawg5yZCoRFohhfKPqT1ZrJ9SnRbW/WR3VTVY76ht5k
 RuV3eb2VWBmPU9zn56Tbe6dvFkBuzHH1JdECAqy1BzFcmQQFBebFzf1XAQARAQAB
 tEhMaWJyZU9mZmljZSBCdWlsZCBUZWFtIChDT0RFIFNJR05JTkcgS0VZKSA8YnVp
 bGRAZG9jdW1lbnRmb3VuZGF0aW9uLm9yZz6JAjcEEwEKACEFAkyzEr0CGwMFCwkI
 BwMFFQoJCAsFFgIDAQACHgECF4AACgkQ9DSh76/urqOc4w//X+74QlyRalcuLNw3
 oJKB1+1z6xxhhpwg1kw5cMMrGu0w0YoPvLDKaiS02DdkIaXDECcQTOoEh7/bYbZq
 6OtE1WyxqHYYOPK5yul5FRwZ5k5HZ7pDFcKCQ72UgWhz+QznRhgZ0jwEWl5Ln3rw
 JpSynIvTXHmQogId0xmcrNQPyckzzugGx4qZFinSOmDGwTgG14NU3vat2iek37Ph
 BLh5V8ohlEoccwwPejtKEWQudg0Q8K7uBuqLUhnJoZodEytqpOvtysuPtGxGXnmD
 7oXtBVEF3X6eFRXDIp81cx2isHK4Krf4z4T9KUimNLHjWRa+ZQtp2pZLHQlblfsn
 CUf6TYZ0Yi909EhcM/hxAgBZXellOCQ/8U2cJsTUyN5Dp1wbf6X0uK4uaed1/037
 EGLAO6PP6WQz6jWd1/hhsQ5oAmdjkzlMFEfKNeIIDuKMOjXcTvM8/KRXhufwICvS
 FBlSIveHfDFWCvOVgq0VjAY7NFMFKRUnRHB58qBamtyhOyscRIvT5QH8HYfUA/YN
 l9FguczYUIQi3t+H1hoHIywdtmRuhYx5WlIUe8FO9QD5RMPbBjVbkCYgdHdxgnJD
 KCoRGsoKlLB7UZc4Ak9j6plZbYtFRonm2MjU4zxblCFNuEqVQ0V/y6/OIGpBYF9Y
 aEAtTgEJd9OmmDCM3d8O0zZHYma5Ag0ETLMSvQEQAMDp0HxSDWd+2Od/aJutCMFe
 8tfw7+nP9gfHOCUqesb88QvRMJgVY6z1aNdMllxTKlsxUiuA6uNcrUAkzDp/qRWR
 58rWIO642PLifng3urJ1cDbSKC+K4RHpQC+hXllMKLqq8dwNy1LO4fPo9SdtUF4B
 ev6enKmo4yCiOGv2tvztPh9gMGYoDncaOsS0t2UPr2MMQIVUmmIzfJBkdOxbZiWO
 doeNbWsYJHQaO+Ahal6SjPHKzhdjeXhZzHl1vqeDkV4MXHprrOwXNXwPiEpkZe2O
 dc7yaMkQc0k8WRrfKHApbnwDx6Mi8HYaf+LvRq7P0eMO9osD1q44wQQvVzk199zp
 MMHS5/kAv7RBNmDOSJQIZ4zT4lzRDODjMf01Ljn02zon12GfJo0WbbpmLulta7uj
 HgMrUU54by8WPFGW0fljXiDX0EpkHhxUsUsfaNfBsFnE+sRxQjNF/ljvofkyApI2
 1OjtEa9krwvgDqaXsL+a2076OsoFpORlTZ30REb0eRS6rEt8M+7s4xTaA7GFxlY/
 N+bnaM8m+ItygfFHHW4H0wLbbgajDeooSTgaheVNF5V9HS0EkN4MNVvtJH7J6drd
 iR1QVhX87n7+JtQzTtCOyfeKjaB+kcbAm/2VOFOeHdig5+BygpXt3IixVq72xmGz
 h0jhY565MjXrqg5O3pvLABEBAAGJAh8EGAEKAAkFAkyzEr0CGwwACgkQ9DSh76/u
 rqPaeg//avI2/a94XlSYtSZb2hVdW3qa9AEypQurqtVrKJfEKFV+ZQBPXbPRy8Mz
 5LMEH1sfD6B4SVGIGJ8opSyieJkcKIke+GMekTWvSqDpFOgY2rw7eHNn/33ZJs3O
 zQOyWz8smE/AIM/5lyiVGuSlU7RjYncf1V9bIBc91q9Edqk4IYUo/7W+yafC0VW/
 8oHUFYjHNaujiOsEoLiXsh9Y0R/6Jxs6fvE4XbCANV/ecN5UX+9BBrNZNN/9GbNr
 6CYGZ57M2f1Pgywy/XvOnEPnJ8aWXUyGLqq34KvMPFPSOeAmFbkFEsB4mdDMFaDw
 rzziiZE/zS8/nKiH4X2JgmLgFsadEihdfYxeDcGbhREK/qA1f3bGnr1j05V07yko
 2FFZdiOr4OgiT5ymgwVUXQ2Aiz+J/C8URjfpcPxetmuDQT9AYfgmMKPNVXPFWuNQ
 dzN5GZbI+E1/cb5+uLNknvjngw2G4PR/4uPHX1HCSftlNawBqWzyun1k+B7/u3Oe
 FebWXcdqSmZuLQ7l0Pkuz/Nlp6M6cKpceL+9zCgaiR5+v9h94VvtXKd/mw9ZLACc
 VcOANiwCtsJP3lt7jRSHtkuUe6vUm5tLS582RfXxoI1BlPjNtG9xAQ3JKBHIXbal
 T18pAFO3t74cxg3h0iI1G51F3oL0DwILP2MBBmardVEp5CMnB/M=
 =1iQB
 -----END PGP PUBLIC KEY BLOCK-----
--- a/SOURCES/libreoffice-6.0.6.1.tar.xz.asc
+++ b/SOURCES/libreoffice-6.0.6.1.tar.xz.asc
@ -1,16 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iQIcBAABAgAGBQJbRQRlAAoJEPQ0oe+v7q6j9CYP/jVao6G/9bad2JfIxhr6X9kb
 7iVBNh4jVTzrOC+sPGykshAZ/WqehJ0XJNm5xB0PfPIZ1rc7tYmpaHnaakw7jH0q
 kLGsbBMgfnNrcboiO7qiVUdgeU5idBLUH8Md/REVLJ34GueMdfvklEcMjoquv3n7
 4h5y0+St8FBLjefp4FyB7LLAnLfcSELZ73idn3w2t+sRp5QvCfYgWKdmarqrbZtk
 bwAFFgsCjSMFz7eqV+xNU1JtuphOGThFHdhe016VmEURQegHHYord3FUf7PGFklp
 xWVfkectZkgOfQCewvNQuYKOUxptkhDRYr8OR0FGRV1yKXJlMZksqvumcEF6scEp
 7+kBtnY8BL50jCMG29hhJ8fkFKsSfTlstkHLpHq1lzKdjpuD1/90gdJCbgowjDbe
 XfmIhH4brEpwxow9RjZ9glb/Akpql7JrUscgta2pLzmQrLEuiAyE61qDAkrKj8nZ
 H5Jpt3zRO5CKpm2kEKkx6auOjvJFIWruMmkPeH5M0eBYjTuZb09f7rEkSPFctOMn
 DXuDa40+Mr+lt9gOp8HtktN+bpIGiwZHLjDcAR1+TEhlriEXo7ydxRl2gjThN8u5
 EqzQ7390B/xrFQ8P13Vqc2ICqM1S3m64tDTmTOZk2kzDAcmjUbg8/a/7kRr3UF7f
 BO4UJvoNZxPlopo/jxM7
 =Z/eu
 -----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uNwACgkQ9DSh76/u
 rqNXhQ/9GhwXWFcV4GyBa3TReuGs+1YrzpUvp+w/MA1wN5czpPwA9CAhivCti1pU
 dWwb2c/BePC+KBPthnjKNbuFIL00UuFuz4evEsNLykgwc3CCPXZDm5sxvJUAt1kf
 QzlL6XQxpk47v2fRs5wY5huO5rv45o33+N1GV1OCm9Y5vo67wWHnnQJCqIKsfEoY
 dWEvfFJxy9c7FiwbRZe9gZctGlOqRJpRbSwffchQ9fJQ5+10w5xhCdd5JrQheqe0
 G0JOHTbPYncv9C9+aTsye5maVEQj/Wi/SH6IzE5T5AGVEf1dguGOr//NLfuPoY0d
 Hrm17tKqsV1Lc7LzSwVAdes87bIjcNkITmfyKiaH3g4gDiL2Op9nsZiSwMad4+LX
 2GDQKfmqTyS1Um1SdqAMJezwlHOExT491arWwjfDeBmMDJfFNxzNRSihbqzFJs5/
 qfRjOSxpH0oRGMV4RSsLxDwjyzKAsUFQ2pZFx6A4qwp/X17+TulI3NnUHSNTMUaA
 rsRgopJb2NuTP3+lTPCotFUcbmFKuCHtAHw8mntyd54JnRHlooVW+/dJ1HyGqAbD
 moPg94GVKB0OPaw7D9hipG5dH1wsBz4vJXTEzJL8D/QOM7EmZDkzomPa/J10Pj4v
 DXUuzAmfU4bShr1wzZvhEBIVDoS8gPGYwArYdCD18bm9NPWrO3k=
 =ItCL
 -----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-base-symbolic.svg
+++ b/SOURCES/libreoffice-base-symbolic.svg
@ -0,0 +1,27 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-base-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='-65.007495' inkscape:cy='2.627089' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-143.00018,-195)'>
    <path inkscape:connector-curvature='0' d='m 154.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path18821' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 144.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path18823' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
    <path inkscape:connector-curvature='0' d='m 148.03145,203.7172 c 0,0.951 0,0 0,0.951 2.10295,1.09462 4,0 4,0 l 0,-0.951 c 0,0 -2.05961,1.05726 -4,0 z' id='path18853' sodipodi:nodetypes='ccccc' style='fill:#bebebe;fill-opacity:1;stroke:none'/>
    <path sodipodi:cx='29.633902' sodipodi:cy='5.3320975' d='m 31.999999,5.3320975 a 2.3660977,0.66790265 0 1 1 -4.732195,0 2.3660977,0.66790265 0 1 1 4.732195,0 z' id='path18855' sodipodi:rx='2.3660977' sodipodi:ry='0.66790265' style='fill:#bebebe;fill-opacity:1;stroke:none' transform='matrix(0.84527458,0,0,1.4972236,124.98267,194.01666)' sodipodi:type='arc'/>
    <path inkscape:connector-curvature='0' d='m 148.03145,205.7172 c 0,0.951 0,0 0,0.951 2.10295,1.09462 4,0 4,0 l 0,-0.951 c 0,0 -2.05961,1.05726 -4,0 z' id='path18864' sodipodi:nodetypes='ccccc' style='fill:#bebebe;fill-opacity:1;stroke:none'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-calc-symbolic.svg
+++ b/SOURCES/libreoffice-calc-symbolic.svg
@ -0,0 +1,27 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-calc-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='19.52026' inkscape:cy='1.7874' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-83.000198,-195)'>
    <path inkscape:connector-curvature='0' d='m 94.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path12998' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 84.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path13000' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
    <rect height='3' id='rect18593' style='fill:#bebebe;fill-opacity:1;stroke:none' transform='scale(-1,1)' width='1.9999983' x='-89.000198' y='204'/>
    <rect height='2' id='rect18595' style='fill:#bebebe;fill-opacity:1;stroke:none' width='2.0000017' x='93.000198' y='205'/>
    <rect height='5' id='rect18597' style='fill:#bebebe;fill-opacity:1;stroke:none' transform='scale(-1,1)' width='2' x='-92.000198' y='202'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-draw-symbolic.svg
+++ b/SOURCES/libreoffice-draw-symbolic.svg
@ -0,0 +1,26 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-draw-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='-45.00751' inkscape:cy='2.627089' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-123.0002,-195)'>
    <path inkscape:connector-curvature='0' d='m 134.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path18767' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 124.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path18769' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
    <path inkscape:connector-curvature='0' d='m 132.0002,203 -3,4 6,0 z' id='path18798' sodipodi:nodetypes='cccc' style='fill:#bebebe;fill-opacity:1;stroke:none'/>
    <path sodipodi:cx='8.203125' sodipodi:cy='4' d='M 10,4 A 1.7968751,2 0 1 1 6.4062499,4 1.7968751,2 0 1 1 10,4 z' id='path18805' sodipodi:rx='1.7968751' sodipodi:ry='2' style='fill:#bebebe;fill-opacity:1;stroke:none' transform='matrix(1.1130434,0,0,1,119.86977,197)' sodipodi:type='arc'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-help-6.0.6.1.tar.xz.asc
+++ b/SOURCES/libreoffice-help-6.0.6.1.tar.xz.asc
@ -1,16 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iQIcBAABAgAGBQJbRQRsAAoJEPQ0oe+v7q6jxGoQAIxhQNVCN8BB4QqbJDILOg81
 IJvogAAlSSC/n105SumrWnrDMmdYx5Sq8kKSKLJaVBUbNwG6f6GYe4eu03QTSG10
 WJ36tvUisx8E7b+ur8kLzGaE7v6S6q0OKkf711ieUnZn/YC1mDNoOr7yYAuNpcCn
 iTdt5war6i1DswCG4wiVrO2fMiZ8oHlvfpHU3TDNPHL+0qcYaGtce6/N5v4jnVLh
 JIqNmQWAbquD+Tljk4AYsL/5vnj8qzTH4VWrL3bjJPBCBDbNoUXlaI6vo5o9AGRN
 OVASSyMahFyNsDRWv7zD9MKkNQ5E5gASgUE8YqyMS1xW++uUARW1cmk7zhGFDd1D
 BTCi9S9hBmEZoNtsIzClInEExugwV5PcY5ShNiXEvN5QyjQMvKmvWLJtYaBVdJUD
 Bcxs52fNyBGsxqzQvfX3+QHXReOIoNCDB8jpatNxaEUYvO+rcaaoRBqfhCiM44fv
 fMbTRCAtCY/9PXK//YWihk303OT2/ZF3+AEHsRPOm9Ykh3EdH1naU9ewM3ZTkDIO
 fSiTLVQTEX5qIo09UgKMpPm0bZnFMHObic5wAYZ56kmEOHVmiGhsHwmHFQe8PlF8
 phb4TLIaaKHQaugonBkX0Gg/9WPz3MT1wCh2kiZSt5Ix/qJgewIav9EMWc/P/LsZ
 wBpki/58B7YsIyEazAK1
 =NeOu
 -----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-help-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-help-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uPgACgkQ9DSh76/u
 rqNc+A/+PnNAFTvU3bHl8dwQGtRxBzcBuz0mkUTHET7qOPkzHsWwiaxmVhrDPvEd
 UvG5NiVzux/YnQpLfG9yFcHH78RHy3RKpYHsuUwlb8AWOpMIB4rX2IU2Kcn6jW1v
 2fokIVEvu5QzbI7sAyrxfAsdTGa+NALCG7oF8HmGVv/iVHZYTFYU7461LEqNSgbB
 uAO9SWV5FLDYxcg6bYHULLFylrD/YBdQrv2Jj16apwVpKNHJPj1qE00KIRl1fYQ6
 PasaGh1D6ZLKhAeOymr18eWQ0VZYmKjszddQExMbLTlxQZI+pZ8Bo6WKz7Y0IiwD
 aCcZeVOYRs40Xc4Mc7+6hxO1bGFrG1CvxPE3gdrTAsPmjRko3CNTRFfPyd/e0pHV
 0hpmIamL+OAE8V3gG5kSmVCtmnjhAtwnzBnqyuSU/J7thDOp0GUM+FBF6pxQPsf7
 IBZCHZALOO727A6+YR2JsBqmpDi+AxEPNaksDm+orkIG2hx5ai5LmfzgqF0gsBRN
 D//oVVpDM34JF5eLD4BOzUv3KqZYSmvDUqnkDF25bMJa5v637VoC7HiPypKRiCn1
 3SLV1YUxMP0EKu2QU7Bz36CLzkxJfEcyvje5//wravbxuDopZC4703fkK1WrANzL
 TviCWo1h03ClV1GEhDNB14hgzVN5kfVxaosve9U2Zyayabszj+s=
 =12X5
 -----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-impress-symbolic.svg
+++ b/SOURCES/libreoffice-impress-symbolic.svg
@ -0,0 +1,25 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-impress-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='-25.00751' inkscape:cy='2.627089' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-103.0002,-195)'>
    <path inkscape:connector-curvature='0' d='m 114.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path18661' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 104.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path18663' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
    <path inkscape:connector-curvature='0' d='m 107.5002,203 c -0.277,0 -0.5,0.223 -0.5,0.5 l 0,4 c 0,0.277 0.223,0.5 0.5,0.5 l 7,0 c 0.277,0 0.5,-0.223 0.5,-0.5 l 0,-4 c 0,-0.277 -0.223,-0.5 -0.5,-0.5 l -7,0 z m 1,1 c 0.27614,0 0.5,0.22386 0.5,0.5 0,0.27614 -0.22386,0.5 -0.5,0.5 -0.27614,0 -0.5,-0.22386 -0.5,-0.5 0,-0.27614 0.22386,-0.5 0.5,-0.5 z m 2,0 3,0 c 0.277,0 0.5,0.223 0.5,0.5 0,0.277 -0.223,0.5 -0.5,0.5 l -3,0 c -0.277,0 -0.5,-0.223 -0.5,-0.5 0,-0.277 0.223,-0.5 0.5,-0.5 z m -2,2 c 0.27614,0 0.5,0.22386 0.5,0.5 0,0.27614 -0.22386,0.5 -0.5,0.5 -0.27614,0 -0.5,-0.22386 -0.5,-0.5 0,-0.27614 0.22386,-0.5 0.5,-0.5 z m 2,0 3,0 c 0.277,0 0.5,0.223 0.5,0.5 0,0.277 -0.223,0.5 -0.5,0.5 l -3,0 c -0.277,0 -0.5,-0.223 -0.5,-0.5 0,-0.277 0.223,-0.5 0.5,-0.5 z' id='rect18746' style='fill:#bebebe;fill-opacity:1;stroke:none'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-main-symbolic.svg
+++ b/SOURCES/libreoffice-main-symbolic.svg
@ -0,0 +1,24 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-main-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='34.99249' inkscape:cy='2.627089' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-43.000198,-195)'>
    <path inkscape:connector-curvature='0' d='m 54.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path6692' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 44.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path14007' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-math-symbolic.svg
+++ b/SOURCES/libreoffice-math-symbolic.svg
@ -0,0 +1,25 @@
 <?xml version='1.0' encoding='UTF-8' standalone='no'?>
 <!-- Created with Inkscape (http://www.inkscape.org/) -->
 <svg xmlns:cc='http://creativecommons.org/ns#' xmlns:dc='http://purl.org/dc/elements/1.1/' sodipodi:docname='libreoffice-math-symbolic.svg' height='16' id='svg7384' xmlns:inkscape='http://www.inkscape.org/namespaces/inkscape' xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:sodipodi='http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd' xmlns:svg='http://www.w3.org/2000/svg' inkscape:version='0.48.2 r9819' version='1.1' width='16' xmlns='http://www.w3.org/2000/svg'>
  <metadata id='metadata90'>
    <rdf:RDF>
      <cc:Work rdf:about=''>
        <dc:format>image/svg+xml</dc:format>
        <dc:type rdf:resource='http://purl.org/dc/dcmitype/StillImage'/>
        <dc:title>Gnome Symbolic Icon Theme</dc:title>
      </cc:Work>
    </rdf:RDF>
  </metadata>
  <sodipodi:namedview inkscape:bbox-paths='true' bordercolor='#666666' borderopacity='1' inkscape:current-layer='layer9' inkscape:cx='-85.00751' inkscape:cy='2.627089' gridtolerance='10' inkscape:guide-bbox='true' guidetolerance='10' id='namedview88' inkscape:object-nodes='false' inkscape:object-paths='false' objecttolerance='10' pagecolor='#555753' inkscape:pageopacity='1' inkscape:pageshadow='2' showborder='false' showgrid='false' showguides='true' inkscape:snap-bbox='false' inkscape:snap-bbox-midpoints='false' inkscape:snap-global='true' inkscape:snap-grids='true' inkscape:snap-nodes='true' inkscape:snap-others='false' inkscape:snap-to-guides='true' inkscape:window-height='1381' inkscape:window-maximized='1' inkscape:window-width='2560' inkscape:window-x='1600' inkscape:window-y='27' inkscape:zoom='22.627417'>
    <inkscape:grid empspacing='2' enabled='true' id='grid4866' snapvisiblegridlinesonly='true' spacingx='1px' spacingy='1px' type='xygrid' visible='true'/>
  </sodipodi:namedview>
  <title id='title9167'>Gnome Symbolic Icon Theme</title>
  <defs id='defs7386'/>
  <g inkscape:groupmode='layer' id='layer9' inkscape:label='apps' style='display:inline' transform='translate(-163.0002,-195)'>
    <path inkscape:connector-curvature='0' d='m 174.28125,195.00525 c -0.27821,0.0752 -0.37465,0.49932 -0.15625,0.68727 l 3.1875,3.18646 c 0.21982,0.23021 0.69212,0.0371 0.6875,-0.28116 l 0,-3.21769 c -0.0122,-0.20318 -0.20269,-0.37897 -0.40625,-0.37488 l -3.1875,0 c -0.0413,-0.007 -0.0837,-0.007 -0.125,0 z' id='path18879' sodipodi:nodetypes='cccccccc' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;block-progression:tb;writing-mode:lr-tb;text-anchor:start;baseline-shift:baseline;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:0.79782361px;marker:none;visibility:visible;display:inline;overflow:visible;enable-background:accumulate;font-family:Sans;-inkscape-font-specification:Sans'/>
    <path inkscape:connector-curvature='0' d='m 164.84395,195.00525 c -0.4813,0.0874 -0.85238,0.53322 -0.84375,0.99967 l 0,13.99541 c 6e-5,0.52341 0.51276,0.99962 1.0625,0.99967 l 11.875,0 c 0.54975,-5e-5 1.06245,-0.47626 1.0625,-0.99967 l -0.0312,-7.59126 c 0.006,-0.26397 -0.0884,-0.52879 -0.28125,-0.71852 l -6.40625,-6.40414 c -0.19927,-0.18364 -0.47275,-0.28728 -0.75,-0.28116 l -5.46875,0 c -0.0654,-0.006 -0.15331,-0.006 -0.21875,0 z m 1.15625,1.99934 4,0 3.5,3.49885 2.5,2.49918 0,5.99804 -10,0 0,-11.99607 z' id='path18881' style='font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-indent:0pt;text-align:start;text-decoration:none;line-height:normal;letter-spacing:normal;word-spacing:normal;text-transform:none;direction:ltr;text-anchor:start;color:#000000;fill:#bebebe;fill-opacity:1;stroke:none;stroke-width:2;marker:none;visibility:visible;display:inline;overflow:visible;font-family:Andale Mono'/>
    <path inkscape:connector-curvature='0' d='m 174.0002,201 -2,0 -2,4 -1,-2 -2,0 0,2 1.45956,0 1.54044,3 2.6029,-5 1.3971,0 z' id='rect13006-2' sodipodi:nodetypes='ccccccccccc' style='fill:#bebebe;fill-opacity:1;stroke:none'/>
  </g>
 </svg>
--- a/SOURCES/libreoffice-translations-6.0.6.1.tar.xz.asc
+++ b/SOURCES/libreoffice-translations-6.0.6.1.tar.xz.asc
@ -1,16 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 iQIcBAABAgAGBQJbRQRvAAoJEPQ0oe+v7q6jLwgQALn0L72pJHBauDOR0RTBI3ha
 2umJnT6QM2N30H5Fe4IiqqH2X0C7kToCRzxZWIbLibMYqjuNbxClOzUsSsQLduJS
 QzfjQSBDwXJy4US650n934vDsyxObKj1e8oVKAyCEen3HGsAPojkKD/C5BaUjDAv
 gzRp2eHKRc75hKDpM5d57o34VSO6cvnhS0t1fOFNzA1xyK+WIuOw401rRNvrcCyu
 Mu273oFREqdDMUjE67s2Pl9H92Xf7aqSKqix+U5eOygSTdBFt91v2ST1/i9Fp0Ra
 PTE7JjR1Cr1pWSzSwZBvXXHXColCr05DWYebOEmbMUzrlxh7VpHkQD85QdN9sHPP
 FYCYfy+oF47lW3mU+2NnTKWoQQKOrIofv8ONJow68VHjoTtW1ktK0S/gz9agwJD3
 L8IGmWDLO+G4QfgKF1/3aMVz/ctoXgpkWEENTm0rUdTB6Fz9QkSQh/ku/krhhF57
 E8/ZCbD48GY97lnRaZdNBCm9+ZV+21bo3ImbpozfWLcF7hxE4w43sn2ms1aeAWdd
 dnGKIOAMHk5YrBbskbLZ1IlgfQnomK5jQ+wspwweGyquucIkTlVhDtINEDjvt9rk
 gliphVVy6WhgFbwblPNq+LEAhN/pSaKwOjE3PMHx2pP+ocS1Uy6kyTOx8JCkDtUH
 GQ8RJwQQPabbGNWiQwjP
 =R9e8
 -----END PGP SIGNATURE-----
--- a/SOURCES/libreoffice-translations-6.4.7.2.tar.xz.asc
+++ b/SOURCES/libreoffice-translations-6.4.7.2.tar.xz.asc
@ -0,0 +1,16 @@
 -----BEGIN PGP SIGNATURE-----
 iQIzBAABCAAdFiEEwoOeytlAj76VMcPp9DSh76/urqMFAl99uPkACgkQ9DSh76/u
 rqOB9g/+OfPvMQSnfDsF4JE93HcL+z6PNa7yEIuflFSLWRxjtBRrep5FPT0mui5a
 PeCkLdR5TcHEQUa4GQuk5C6VLSbyQuEVoiO89Zj+xnLQGd96QJ5hyGjRqzPeP0kr
 KSq59cdT1PMETcZy4IQlqVKV7a71pBgCKXh1t3cr56rD8h97jh3lNqOU++6pmpYH
 F+IA4/GuWYA22M3oP+w0zmIR4HAdQB5RhxcAMQuLy+N7QUGRU27EMq8R8niRBp8G
 Hb8MqVSdy19Hz9GKc3sNHFg4GIEywf/6CY+ldaca63F0X/KWCYYY5Ql3K180LAjG
 wg6apwPynkCK05YjqlS8SedZlew9pH3sIauRM99aNC742EqsNoEY1dLEFWErdrr9
 tub2bc5nYX7Ku6RXhlL5orXdU0quZH3c7n26g7VWI6rKvSh4Bs1godWs1UK5hqTt
 jt/4RaMBvWzFTWbgQsWI3NLmTM/EOHAfhjDqTq5QPi+Wo3NaqBTlF1TiXJiLDWux
 rBb+FcnMmeWrFLCtvKk8T5jYzv0e/HtLH4o3rWaNwzuBAgeeZrroQpTneIVqv8+L
 HbE/GN1TaVIkc28RpX2PXdh918p1tmHNuKcPNQD+KIRP+FiBVfpFYm4/BtTb7nQU
 Nzh0AxSSSgNcaZaj7iegb/m55BGBhMRjm2iA3bCNNG8JapOfIrs=
 =Ot5W
 -----END PGP SIGNATURE-----
--- a/Show More
+++ b/Show More