40 changed files with 11571 additions and 8 deletions
--- a/.gitignore
+++ b/.gitignore
@ -2,7 +2,6 @@ SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip
 SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
 SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
-SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
 SOURCES/libreoffice-6.4.7.2.tar.xz
 SOURCES/libreoffice-help-6.4.7.2.tar.xz
 SOURCES/libreoffice-translations-6.4.7.2.tar.xz
--- a/.libreoffice.metadata
+++ b/.libreoffice.metadata
@ -2,7 +2,6 @@
 0619ed3a89644bef318df67db12045b2b590585b SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll
 d336802a36ed2c87dd243e7c2f1d0542dace5cca SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf
 2d49e11b0b711970f494294dc3698f05eb294853 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip
-7b5fd93d787fbc6d9c2d4025d543730ee8dc4559 SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
 b29d8cdb3db8d6b317e1cb9117b020d7e676e601 SOURCES/libreoffice-6.4.7.2.tar.xz
 ca7e087ef62f30c033db84ceb0f6a4021f53653e SOURCES/libreoffice-help-6.4.7.2.tar.xz
 0f74fd6286e71ff2b7c7bc01f41c8972e354d81c SOURCES/libreoffice-translations-6.4.7.2.tar.xz
--- a/SOURCES/0001-CVE-2021-25636.patch
+++ b/SOURCES/0001-CVE-2021-25636.patch
@ -0,0 +1,69 @@
+From ae1bd20a2d4d7b7d64edc3b06d7f901c05175b7d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 20 Dec 2021 17:05:44 +0000
+Subject: [PATCH] only use X509Data
+
+Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+(cherry picked from commit b0404f80577de9ff69e58390c6f6ef949fdb0139)
+---
+ .../source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx      | 6 ++++++
+ xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx      | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+index db400e6..39f9d7f 100644
+--- a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+++ b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+@@ -21,6 +21,8 @@
+ #include <sal/log.hxx>
+ #include <rtl/uuid.h>
+ 
+#include <xmlsec/mscng/x509.h>
+
+ #include <com/sun/star/xml/crypto/SecurityOperationStatus.hpp>
+ #include <com/sun/star/xml/crypto/XXMLSignature.hpp>
+ 
+@@ -229,6 +231,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
+     // We do certificate verification ourselves.
+     pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
+    // limit possible key data to valid X509 certificates only, no KeyValues
+    if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
+        throw RuntimeException("failed to limit allowed key data");
+
+     //Verify signature
+     //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
+     //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if
+diff --git a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+index 827580b..8f4d6f8 100644
+--- a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+++ b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+@@ -19,6 +19,8 @@
+ 
+ #include <sal/config.h>
+ 
+#include <xmlsec/nss/x509.h>
+
+ #include <xmlelementwrapper_xmlsecimpl.hxx>
+ #include <xmlsec/xmlstreamio.hxx>
+ #include <xmlsec/errorcallback.hxx>
+@@ -243,6 +245,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
+         // We do certificate verification ourselves.
+         pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
+        // limit possible key data to valid X509 certificates only, no KeyValues
+        if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
+            throw RuntimeException("failed to limit allowed key data");
+
+         //Verify signature
+         int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );
+ 
+-- 
+2.33.1
+
--- a/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
+++ b/SOURCES/0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
@ -0,0 +1,63 @@
+From 77f30ada1156ca1e1357776fea8e9dc113f6898d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 3 Mar 2022 14:22:37 +0000
+Subject: [PATCH 1/4] CVE-2022-26305 compare authors using Thumbprint
+
+Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8)
+---
+ .../component/documentdigitalsignatures.cxx   | 23 +++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+index b9066ea92cac..5a21c8421bec 100644
+--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+@@ -19,9 +19,10 @@
+ 
+ #include <resourcemanager.hxx>
+ 
+-#include <digitalsignaturesdialog.hxx>
+#include <certificate.hxx>
+ #include <certificatechooser.hxx>
+ #include <certificateviewer.hxx>
+#include <digitalsignaturesdialog.hxx>
+ #include <macrosecurity.hxx>
+ #include <biginteger.hxx>
+ #include <strings.hrc>
+@@ -666,9 +667,23 @@ sal_Bool DocumentDigitalSignatures::isAuthorTrusted(
+     Sequence< SvtSecurityOptions::Certificate > aTrustedAuthors = SvtSecurityOptions().GetTrustedAuthors();
+ 
+     return std::any_of(aTrustedAuthors.begin(), aTrustedAuthors.end(),
+-        [&xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
+-            return xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName())
+-                && ( rAuthor[1] == sSerialNum );
+        [this, &xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
+            if (!xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName()))
+                return false;
+            if (rAuthor[1] != sSerialNum)
+                return false;
+
+            DocumentSignatureManager aSignatureManager(mxCtx, {});
+            if (!aSignatureManager.init())
+                return false;
+            uno::Reference<css::security::XCertificate> xCert = aSignatureManager.getSecurityEnvironment()->createCertificateFromAscii(rAuthor[2]);
+
+            auto pAuthor = dynamic_cast<xmlsecurity::Certificate*>(xAuthor.get());
+            auto pCert = dynamic_cast<xmlsecurity::Certificate*>(xCert.get());
+            if (pAuthor && pCert)
+                return pCert->getSHA256Thumbprint() == pAuthor->getSHA256Thumbprint();
+
+            return xCert->getSHA1Thumbprint() == xAuthor->getSHA1Thumbprint();
+         });
+ }
+ 
+-- 
+2.37.1
+
--- a/SOURCES/0001-CVE-2022-3140.patch
+++ b/SOURCES/0001-CVE-2022-3140.patch
@ -0,0 +1,279 @@
+From 3831e68bffc233f581e3eb1cb3c7ed925daab86f Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Tue, 30 Aug 2022 14:04:52 +0200
+Subject: [PATCH] Filter out unwanted command URIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139225
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 27d29f7df428885865a8e2313283839b20f2a34b)
+Conflicts:
+	desktop/source/app/cmdlineargs.cxx
+
+Change-Id: I0b7e5329af8cc053d14d5c60ec14fe7f364ef993
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139182
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit da291e2960b75153f41d440a1b41961567432e8c)
+
+These commands are always URLs already
+
+Change-Id: I5083765c879689d7f933bbe00ad70bb68e635a21
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139042
+Tested-by: Jean-Pierre Ledure <jp@ledure.be>
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit e61701e1ee6763de72b397e6ade1124eca9400f3)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138980
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 5b4025bb56999f5c895c6f7e0b52f521800d65b0)
+
+check IFrame "FrameURL" target
+
+similiar to
+
+commit b3edf85e0fe6ca03dc26e1bf531be82193bc9627
+Date:   Wed Aug 7 17:37:11 2019 +0100
+
+    warn on load when a document binds an event to a macro
+
+Change-Id: Iea888b1c083d2dc69ec322309ac9ae8c5e5eb315
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139059
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit c7450d0b9d02c64ae3da467d329040787039767e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139117
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+(cherry picked from commit f5e3b0a7966d7d28817292adbb58fb43f28b7c6d)
+
+check impress/calc IFrame "FrameURL" target
+
+similar to
+
+commit c7450d0b9d02c64ae3da467d329040787039767e
+Date:   Tue Aug 30 17:01:08 2022 +0100
+
+    check IFrame "FrameURL" target
+
+Change-Id: Ibf28c29acb4476830431d02772f3ecd4b23a6a27
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139495
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit d0312786571221c2dd4f63fa69f6f0489d7d39ec)
+---
+ desktop/source/app/cmdlineargs.cxx   | 10 +++++++++-
+ sfx2/source/appl/macroloader.cxx     |  9 +++++++--
+ sfx2/source/doc/iframe.cxx           | 21 ++++++++++++++++-----
+ sfx2/source/inc/macroloader.hxx      |  2 ++
+ sw/source/filter/html/htmlplug.cxx   |  7 ++++++-
+ sw/source/filter/xml/xmltexti.cxx    |  9 +++++++--
+ wizards/source/access2base/DoCmd.xba |  2 +-
+ xmloff/source/draw/ximpshap.cxx      |  4 ++++
+ 8 files changed, 52 insertions(+), 12 deletions(-)
+
+diff --git a/desktop/source/app/cmdlineargs.cxx b/desktop/source/app/cmdlineargs.cxx
+index 381147c..5babfbe 100644
+--- a/desktop/source/app/cmdlineargs.cxx
+++ b/desktop/source/app/cmdlineargs.cxx
+@@ -27,6 +27,7 @@
+ 
+ #include "cmdlineargs.hxx"
+ #include <tools/stream.hxx>
+#include <tools/urlobj.hxx>
+ #include <vcl/svapp.hxx>
+ #include <rtl/uri.hxx>
+ #include <rtl/ustring.hxx>
+@@ -169,7 +170,14 @@ CommandLineEvent CheckOfficeURI(/* in,out */ OUString& arg, CommandLineEvent cur
+     }
+     if (nURIlen < 0)
+         nURIlen = rest2.getLength();
+-    arg = rest2.copy(0, nURIlen);
+    auto const uri = rest2.copy(0, nURIlen);
+    if (INetURLObject(uri).GetProtocol() == INetProtocol::Macro) {
+        // Let the "Open" machinery process the full command URI (leading to failure, by intention,
+        // as the "Open" machinery does not know about those command URI schemes):
+        curEvt = CommandLineEvent::Open;
+    } else {
+        arg = uri;
+    }
+     return curEvt;
+ }
+ 
+diff --git a/sfx2/source/appl/macroloader.cxx b/sfx2/source/appl/macroloader.cxx
+index 98e036e..b50d1e6 100644
+--- a/sfx2/source/appl/macroloader.cxx
+++ b/sfx2/source/appl/macroloader.cxx
+@@ -76,10 +76,10 @@ css::uno::Sequence<OUString> SAL_CALL SfxMacroLoader::getSupportedServiceNames()
+     return aSeq;
+ }
+ 
+-SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+SfxObjectShell* SfxMacroLoader::GetObjectShell(const Reference <XFrame>& xFrame)
+ {
+     SfxObjectShell* pDocShell = nullptr;
+-    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
+
+     if ( xFrame.is() )
+     {
+         SfxFrame* pFrame=nullptr;
+@@ -96,6 +96,11 @@ SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+     return pDocShell;
+ }
+ 
+SfxObjectShell* SfxMacroLoader::GetObjectShell_Impl()
+{
+    Reference < XFrame > xFrame( m_xFrame.get(), UNO_QUERY );
+    return SfxMacroLoader::GetObjectShell(xFrame);
+}
+ 
+ uno::Reference<frame::XDispatch> SAL_CALL SfxMacroLoader::queryDispatch(
+     const util::URL&   aURL            ,
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 8b12715..b5291b2 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -39,11 +39,13 @@
+ #include <svl/ownlist.hxx>
+ #include <svl/itemprop.hxx>
+ #include <sfx2/frmdescr.hxx>
+#include <sfx2/objsh.hxx>
+ #include <sfx2/sfxdlg.hxx>
+ #include <sfx2/sfxsids.hrc>
+ #include <toolkit/helper/vclunohelper.hxx>
+ #include <vcl/window.hxx>
+ #include <tools/debug.hxx>
+#include <macroloader.hxx>
+ 
+ using namespace ::com::sun::star;
+ 
+@@ -159,6 +161,19 @@ sal_Bool SAL_CALL IFrameObject::load(
+ {
+     if ( SvtMiscOptions().IsPluginsEnabled() )
+     {
+        util::URL aTargetURL;
+        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+        xTrans->parseStrict( aTargetURL );
+
+        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+        {
+            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+            if (pDoc && !pDoc->AdjustMacroMode())
+                return false;
+        }
+
+         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+@@ -181,16 +196,12 @@ sal_Bool SAL_CALL IFrameObject::load(
+         if ( xFramesSupplier.is() )
+             mxFrame->setCreator( xFramesSupplier );
+ 
+-        util::URL aTargetURL;
+-        aTargetURL.Complete = maFrmDescr.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+-        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+-        xTrans->parseStrict( aTargetURL );
+-
+         uno::Sequence < beans::PropertyValue > aProps(2);
+         aProps[0].Name = "PluginMode";
+         aProps[0].Value <<= sal_Int16(2);
+         aProps[1].Name = "ReadOnly";
+         aProps[1].Value <<= true;
+
+         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
+         if ( xDisp.is() )
+             xDisp->dispatch( aTargetURL, aProps );
+diff --git a/sfx2/source/inc/macroloader.hxx b/sfx2/source/inc/macroloader.hxx
+index 9e1dfba..b3e7a5e 100644
+--- a/sfx2/source/inc/macroloader.hxx
+++ b/sfx2/source/inc/macroloader.hxx
+@@ -82,6 +82,8 @@ public:
+     virtual void SAL_CALL addStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
+ 
+     virtual void SAL_CALL removeStatusListener( const css::uno::Reference< css::frame::XStatusListener >& xControl, const css::util::URL& aURL ) override;
+
+    static SfxObjectShell* GetObjectShell(const css::uno::Reference<css::frame::XFrame>& xFrame);
+ };
+ 
+ #endif
+diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
+index a0da671..eb70704 100644
+--- a/sw/source/filter/html/htmlplug.cxx
+++ b/sw/source/filter/html/htmlplug.cxx
+@@ -1087,7 +1087,12 @@ void SwHTMLParser::InsertFloatingFrame()
+                 bool bHasBorder = aFrameDesc.HasFrameBorder();
+                 Size aMargin = aFrameDesc.GetMargin();
+ 
+-                xSet->setPropertyValue("FrameURL", uno::makeAny( aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE ) ) );
+                OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+
+                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                    NotifyMacroEventRead();
+
+                xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
+                 xSet->setPropertyValue("FrameName", uno::makeAny( aName ) );
+ 
+                 if ( eScroll == ScrollingMode::Auto )
+diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
+index 788bec5..72a14b9 100644
+--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
+@@ -853,9 +853,14 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
+             uno::Reference < beans::XPropertySet > xSet( xObj->getComponent(), uno::UNO_QUERY );
+             if ( xSet.is() )
+             {
+                OUString sHRef = URIHelper::SmartRel2Abs(
+                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
+
+                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                    GetXMLImport().NotifyMacroEventRead();
+
+                 xSet->setPropertyValue("FrameURL",
+-                    makeAny( URIHelper::SmartRel2Abs(
+-                            INetURLObject( GetXMLImport().GetBaseURL() ), rHRef ) ) );
+                    makeAny( rHRef ) );
+ 
+                 xSet->setPropertyValue("FrameName",
+                     makeAny( rName ) );
+diff --git a/wizards/source/access2base/DoCmd.xba b/wizards/source/access2base/DoCmd.xba
+index 27b0d74..26755a8 100644
+--- a/wizards/source/access2base/DoCmd.xba
+++ b/wizards/source/access2base/DoCmd.xba
+@@ -2655,7 +2655,7 @@ Private Sub _ShellExecute(sCommand As String)
+ 
+ Dim oShell As Object
+ 	Set oShell = createUnoService(&quot;com.sun.star.system.SystemShellExecute&quot;)
+-	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.DEFAULTS)
+	oShell.execute(sCommand, &quot;&quot; , com.sun.star.system.SystemShellExecuteFlags.URIS_ONLY)
+ 
+ End Sub				&apos;	_ShellExecute			V0.8.5
+ 
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index 2e509f8..ae35f1e 100644
+--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
+@@ -87,6 +87,7 @@
+ #include <basegfx/polygon/b2dpolypolygon.hxx>
+ #include <basegfx/polygon/b2dpolypolygontools.hxx>
+ #include <basegfx/vector/b2dvector.hxx>
+#include <tools/urlobj.hxx>
+ #include <o3tl/safeint.hxx>
+ 
+ using namespace ::com::sun::star;
+@@ -3243,6 +3244,9 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+ 
+             if( !maHref.isEmpty() )
+             {
+                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
+                    GetImport().NotifyMacroEventRead();
+
+                 xProps->setPropertyValue("FrameURL", Any(maHref) );
+             }
+         }
+-- 
+2.37.3
+
--- a/SOURCES/0001-CVE-2022-38745.patch
+++ b/SOURCES/0001-CVE-2022-38745.patch
@ -0,0 +1,93 @@
+From 36c5c16b7846ff31f403913ad5cdddf8b22fda43 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Mon, 21 Feb 2022 11:55:21 +0100
+Subject: [PATCH] Avoid unnecessary empty -Djava.class.path=
+
+Change-Id: Idcfe7321077b60381c0273910b1faeb444ef1fd8
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130242
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+---
+ .../plugins/sunmajor/pluginlib/sunjavaplugin.cxx | 16 +++++++++++++---
+ jvmfwk/source/framework.cxx                      |  8 ++++++--
+ jvmfwk/source/fwkbase.cxx                        |  3 +++
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+index 4760ab6..ea133ea 100644
+--- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+@@ -687,17 +687,22 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+     // all versions below 1.5.1
+     options.emplace_back("abort", reinterpret_cast<void*>(abort_handler));
+     bool hasStackSize = false;
+#ifdef UNX
+    // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
+    // in the class path in order to have applet support:
+    OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
+#endif
+     for (int i = 0; i < cOptions; i++)
+     {
+         OString opt(arOptions[i].optionString);
+ #ifdef UNX
+-        // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
+-        // in the class path in order to have applet support:
+         if (opt.startsWith("-Djava.class.path="))
+         {
+-            OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
+             if (!sAddPath.isEmpty())
+            {
+                 opt += OStringChar(SAL_PATHSEPARATOR) + sAddPath;
+                sAddPath.clear();
+            }
+         }
+ #endif
+         if (opt == "-Xint") {
+@@ -742,6 +747,11 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+         }
+ #endif
+     }
+#ifdef UNX
+    if (!sAddPath.isEmpty()) {
+        options.emplace_back("-Djava.class.path=" + sAddPath, nullptr);
+    }
+#endif
+ 
+     std::unique_ptr<JavaVMOption[]> sarOptions(new JavaVMOption[options.size()]);
+     for (std::vector<Option>::size_type i = 0; i != options.size(); ++i) {
+diff --git a/jvmfwk/source/framework.cxx b/jvmfwk/source/framework.cxx
+index 3212030..f532ebd 100644
+--- a/jvmfwk/source/framework.cxx
+++ b/jvmfwk/source/framework.cxx
+@@ -210,8 +210,12 @@ javaFrameworkError jfw_startVM(
+                 //In direct mode the options are specified by bootstrap variables
+                 //of the form UNO_JAVA_JFW_PARAMETER_1 .. UNO_JAVA_JFW_PARAMETER_n
+                 vmParams = jfw::BootParams::getVMParameters();
+-                sUserClassPath =
+-                    "-Djava.class.path=" + jfw::BootParams::getClasspath();
+                auto const cp = jfw::BootParams::getClasspath();
+                if (!cp.isEmpty())
+                {
+                    sUserClassPath =
+                        "-Djava.class.path=" + cp;
+                }
+             }
+             else
+                 OSL_ASSERT(false);
+diff --git a/jvmfwk/source/fwkbase.cxx b/jvmfwk/source/fwkbase.cxx
+index ece4dd2..93c32a7 100644
+--- a/jvmfwk/source/fwkbase.cxx
+++ b/jvmfwk/source/fwkbase.cxx
+@@ -460,6 +460,9 @@ OString makeClassPathOption(OUString const & sUserClassPath)
+ 
+     sPaths = OUStringToOString(
+         sBufCP.makeStringAndClear(), osl_getThreadTextEncoding());
+    if (sPaths.isEmpty()) {
+        return "";
+    }
+ 
+     OString sOptionClassPath = "-Djava.class.path=" + sPaths;
+     return sOptionClassPath;
+-- 
+2.39.2
+
--- a/SOURCES/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
+++ b/SOURCES/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
@ -0,0 +1,69 @@
+From 6167f5815aefa78a70517c8e2acbdd7b9c9be27d Mon Sep 17 00:00:00 2001
+Message-ID: <6167f5815aefa78a70517c8e2acbdd7b9c9be27d.1703003067.git.erack@redhat.com>
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Fri, 3 Nov 2023 14:20:07 +0000
+Subject: [PATCH] escape url passed to gstreamer
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
+
+This is a multi-part message in MIME format.
+--------------erAck-patch-parts
+Content-Type: text/plain; charset=UTF-8; format=fixed
+Content-Transfer-Encoding: 8bit
+
+
+Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159583
+
+erAck: backported to 7.1.8.1
+
+---
+ avmedia/source/gstreamer/gstframegrabber.cxx | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+
+--------------erAck-patch-parts
+Content-Type: text/x-patch; name="0001-escape-url-passed-to-gstreamer.patch"
+Content-Transfer-Encoding: 8bit
+Content-Disposition: attachment; filename="0001-escape-url-passed-to-gstreamer.patch"
+
+diff --git a/avmedia/source/gstreamer/gstframegrabber.cxx b/avmedia/source/gstreamer/gstframegrabber.cxx
+index ece799d87530..25170a296e66 100644
+--- a/avmedia/source/gstreamer/gstframegrabber.cxx
+++ b/avmedia/source/gstreamer/gstframegrabber.cxx
+@@ -51,11 +51,9 @@ void FrameGrabber::disposePipeline()
+ FrameGrabber::FrameGrabber( const OUString &rURL ) :
+     FrameGrabber_BASE()
+ {
+-    gchar *pPipelineStr;
+-    pPipelineStr = g_strdup_printf(
+-        "uridecodebin uri=%s ! videoconvert ! videoscale ! appsink "
+-        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"",
+-        OUStringToOString( rURL, RTL_TEXTENCODING_UTF8 ).getStr() );
+    const char pPipelineStr[] =
+        "uridecodebin name=source ! videoconvert ! videoscale ! appsink "
+        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"";
+ 
+     GError *pError = nullptr;
+     mpPipeline = gst_parse_launch( pPipelineStr, &pError );
+@@ -66,6 +64,12 @@ FrameGrabber::FrameGrabber( const OUString &rURL ) :
+     }
+ 
+     if( mpPipeline ) {
+
+        if (GstElement *pUriDecode = gst_bin_get_by_name(GST_BIN(mpPipeline), "source"))
+            g_object_set(pUriDecode, "uri", OUStringToOString(rURL, RTL_TEXTENCODING_UTF8).getStr(), nullptr);
+        else
+            g_warning("Missing 'source' element in gstreamer pipeline");
+
+         // pre-roll
+         switch( gst_element_set_state( mpPipeline, GST_STATE_PAUSED ) ) {
+         case GST_STATE_CHANGE_FAILURE:
+
+--------------erAck-patch-parts--
+
+
--- a/SOURCES/0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch
+++ b/SOURCES/0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch
@ -0,0 +1,93 @@
+From 37d73a1ab94b43e03866d5a910cb58331543b8c3 Mon Sep 17 00:00:00 2001
+Message-ID: <37d73a1ab94b43e03866d5a910cb58331543b8c3.1703086247.git.erack@redhat.com>
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Fri, 3 Nov 2023 17:14:26 +0000
+Subject: [PATCH] add some protocols that don't make sense as floating frame
+ targets
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
+
+This is a multi-part message in MIME format.
+--------------erAck-patch-parts
+Content-Type: text/plain; charset=UTF-8; format=fixed
+Content-Transfer-Encoding: 8bit
+
+
+Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159582
+
+erAck: backported to 7.1.8.1
+
+---
+ include/tools/urlobj.hxx     | 5 +++++
+ sfx2/source/doc/iframe.cxx   | 5 ++++-
+ tools/source/fsys/urlobj.cxx | 8 ++++++++
+ 3 files changed, 17 insertions(+), 1 deletion(-)
+
+
+--------------erAck-patch-parts
+Content-Type: text/x-patch; name="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
+Content-Transfer-Encoding: 8bit
+Content-Disposition: attachment; filename="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
+
+diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx
+index 9d6820ddf241..dfd658722826 100644
+--- a/include/tools/urlobj.hxx
+++ b/include/tools/urlobj.hxx
+@@ -915,6 +915,11 @@ public:
+ 
+     void changeScheme(INetProtocol eTargetScheme);
+ 
+    // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot,
+    // vnd.sun.star.script, etc. All the types of URLs which shouldn't
+    // be accepted from an outside controlled source
+    bool IsExoticProtocol() const;
+
+ private:
+     // General Structure:
+ 
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 150218b436e9..b81ce82fd32e 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -168,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load(
+         xTrans->parseStrict( aTargetURL );
+ 
+         INetURLObject aURLObject(aTargetURL.Complete);
+-        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
+        if (aURLObject.IsExoticProtocol())
+        {
+            //SAL_WARN("sfx", "IFrameObject::load ignoring: " << aTargetURL.Complete);
+             return false;
+        }
+ 
+         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
+index 764bb28ef623..2a9f7bc3d7dc 100644
+--- a/tools/source/fsys/urlobj.cxx
+++ b/tools/source/fsys/urlobj.cxx
+@@ -4829,4 +4829,12 @@ OUString INetURLObject::CutExtension()
+         ? aTheExtension : OUString();
+ }
+ 
+bool INetURLObject::IsExoticProtocol() const
+{
+    return m_eScheme == INetProtocol::Slot ||
+           m_eScheme == INetProtocol::Macro ||
+           m_eScheme == INetProtocol::Uno ||
+           isSchemeEqualTo(u"vnd.sun.star.script");
+}
+
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+
+--------------erAck-patch-parts--
+
+
--- a/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch
+++ b/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch
@ -0,0 +1,29 @@
+From 3c25a1e4885a91b1a2fbfd873633f055caa50745 Mon Sep 17 00:00:00 2001
+From: Caolán McNamara <caolan.mcnamara@collabora.com>
+Date: Wed, 27 Mar 2024 17:07:20 +0000
+Subject: [PATCH] add notify for script use
+
+Change-Id: I84af197cec7755f6803a578e1e21c03966ad5f3e
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165410
+Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit a4a5c6b63599bca1f084bb90875f6fd8e15184ac)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167421
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+---
+
+diff --git a/xmloff/source/draw/eventimp.cxx b/xmloff/source/draw/eventimp.cxx
+index f9e10c1..fcc36f9 100644
+--- a/xmloff/source/draw/eventimp.cxx
+++ b/xmloff/source/draw/eventimp.cxx
+@@ -231,6 +231,9 @@
+ 
+     if( maData.mbValid )
+         maData.mbValid = !sEventName.isEmpty();
+
+    if (!maData.msMacroName.isEmpty())
+        rImp.NotifyMacroEventRead();
+ }
+ 
+ SvXMLImportContextRef SdXMLEventContext::CreateChildContext( sal_uInt16 nPrefix, const OUString& rLocalName, const Reference< XAttributeList>& xAttrList )
--- a/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch
+++ b/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch
@ -0,0 +1,81 @@
+From 4e997c62fd6edf6c3fe9e553cc92c77fd48f039c Mon Sep 17 00:00:00 2001
+Message-ID: <4e997c62fd6edf6c3fe9e553cc92c77fd48f039c.1723718921.git.erack@redhat.com>
+From: Sarper Akdemir <sarper.akdemir@allotropia.de>
+Date: Tue, 11 Jun 2024 12:39:36 +0200
+Subject: [PATCH] remove ability to trust not validated macro signatures in
+ high security
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
+
+This is a multi-part message in MIME format.
+--------------erAck-patch-parts
+Content-Type: text/plain; charset=UTF-8; format=fixed
+Content-Transfer-Encoding: 8bit
+
+
+Giving the user the option to determine if they should trust an
+invalid signature in HIGH macro security doesn't make sense.
+CommonName of the signature is the most prominent feature presented
+and the CommonName of a certificate can be easily forged for an
+invalid signature, tricking the user into accepting an invalid
+signature.
+
+in the HIGH macro security setting only show the pop-up to
+enable/disable signed macro if the certificate signature can be
+validated.
+
+cherry-picked without UI/String altering bits for 24-2
+
+Change-Id: Ia766fb701660160ee5dc9f6e077f4012a44ce721
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168667
+Tested-by: Jenkins
+Reviewed-by: Sarper Akdemir <sarper.akdemir@allotropia.de>
+(cherry picked from commit 2beaa3be3829303e948d401f492dbfd239d60aad)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169525
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171306
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171314
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171315
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171317
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171323
+---
+ sfx2/source/doc/docmacromode.cxx | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+
+--------------erAck-patch-parts
+Content-Type: text/x-patch; name="0001-remove-ability-to-trust-not-validated-macro-signatur.patch"
+Content-Transfer-Encoding: 8bit
+Content-Disposition: attachment; filename="0001-remove-ability-to-trust-not-validated-macro-signatur.patch"
+
+diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
+index 8a617b1785c6..997a8f739395 100644
+--- a/sfx2/source/doc/docmacromode.cxx
+++ b/sfx2/source/doc/docmacromode.cxx
+@@ -229,14 +229,18 @@ namespace sfx2
+             // check whether the document is signed with trusted certificate
+             if ( nMacroExecutionMode != MacroExecMode::FROM_LIST )
+             {
+                SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState();
+
+                 // the trusted macro check will also retrieve the signature state ( small optimization )
+                 const SvtSecurityOptions aSecOption;
+                 const bool bAllowUIToAddAuthor = nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_NO_WARN
+                                                  && (nMacroExecutionMode == MacroExecMode::ALWAYS_EXECUTE
+-                                                     || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors));
+                                                     || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors))
+                                                 && (nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_WARN
+                                                     || nSignatureState == SignatureState::OK);
+
+                 const bool bHasTrustedMacroSignature = m_xData->m_rDocumentAccess.hasTrustedScriptingSignature(bAllowUIToAddAuthor);
+ 
+-                SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState();
+                 if ( nSignatureState == SignatureState::BROKEN )
+                 {
+                     if (!bAllowUIToAddAuthor)
+
+--------------erAck-patch-parts--
+
+
--- a/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
+++ b/SOURCES/0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
@ -0,0 +1,50 @@
+From 78fd31b17931e1217d3b11fcbd13a41d79d99055 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 11:41:05 +0200
+Subject: [PATCH] Convert attribute value to UTF-8 when passing it to libxml2
+
+Using toUtf8, requiring the OUString to actually contain well-formed data, but
+which is likely OK for this test-code--only function, and is also what similar
+dumpAsXml functions e.g. in editeng/source/items/textitem.cxx already use.
+
+This appears to have been broken ever since the code's introduction in
+553f10c71a2cc92f5f5890e24948f5277e3d2758 "add dumpAsXml() to more pool items",
+and it would typically only have written the leading zero or one
+(depending on the architecture's endianness) characters.  (I ran across it on
+big-endian s390x, where CppunitTest_sd_tiledrendering
+SdTiledRenderingTest::testTdf104405 failed because of
+
+> Entity: line 2: parser error : Input is not proper UTF-8, indicate encoding !
+> Bytes: 0xCF 0x22 0x2F 0x3E
+> ation=""/><SfxPoolItem whichId="4017" typeName="13SvxBulletItem" presentation="%
+>                                                                                ^
+
+apparently reported from within libxml2.)
+
+Change-Id: I4b116d3be84098bd8b8a13b6937da70a1ee02c7f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103236
+Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit fd9422febc384208558487bfe4a69ec89ab0ddca)
+---
+ svl/source/items/poolitem.cxx | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/svl/source/items/poolitem.cxx b/svl/source/items/poolitem.cxx
+index ec37b68d3417..ad07a0b60b4b 100644
+--- a/svl/source/items/poolitem.cxx
+++ b/svl/source/items/poolitem.cxx
+@@ -548,7 +548,8 @@ void SfxPoolItem::dumpAsXml(xmlTextWriterPtr pWriter) const
+     OUString rText;
+     IntlWrapper aIntlWrapper(SvtSysLocale().GetUILanguageTag());
+     if (GetPresentation( SfxItemPresentation::Complete, MapUnit::Map100thMM, MapUnit::Map100thMM, rText, aIntlWrapper))
+-        xmlTextWriterWriteAttribute(pWriter, BAD_CAST("presentation"), BAD_CAST(rText.getStr()));
+        xmlTextWriterWriteAttribute(
+            pWriter, BAD_CAST("presentation"), BAD_CAST(rText.toUtf8().getStr()));
+     xmlTextWriterEndElement(pWriter);
+ }
+ 
+-- 
+2.33.1
+
--- a/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
+++ b/SOURCES/0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
@ -0,0 +1,65 @@
+From 41594786266265c1b7d5116ab85b38af0cd1fd59 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 12:01:35 +0200
+Subject: [PATCH] Correctly read PNG into bitmaps N32BitTcA... formats (where
+ alpha comes first)
+
+This appears to be a regression introduced with
+86ea64f216819696cd86d1926aff0a138ace2baf "Support for native 32bit Bitmap in VCL
+and SVP (cairo) backend".  It caused CppunitTest_vcl_png_test to fail on
+(big-endian) Linux s390x with
+
+> vcl/qa/cppunit/png/PngFilterTest.cxx:176:PngFilterTest::testPng
+> equality assertion failed
+> - Expected: c[ff000040]
+> - Actual  : c[0000ff40]
+
+where eFormat happens to be ScanlineFormat::N32BitTcArgb, vs.
+ScanlineFormat::N32BitTcBgra on e.g. Linux x86-64 (and which thus didn't notice
+the lack of support for N32BitTcA... formats where alpha goes first instead of
+last).
+
+Change-Id: Id6030468718f6ef831b42f2b5ad7ba2c4c46a805
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103240
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 0387077e6647d7a30fd36d4ec41dfc559afe45c3)
+---
+ vcl/source/filter/png/PngImageReader.cxx | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/vcl/source/filter/png/PngImageReader.cxx b/vcl/source/filter/png/PngImageReader.cxx
+index 958cae34eb46..6e9f3825face 100644
+--- a/vcl/source/filter/png/PngImageReader.cxx
+++ b/vcl/source/filter/png/PngImageReader.cxx
+@@ -188,6 +188,8 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
+                     for (auto& rRow : aRows)
+                         rRow.resize(aRowSizeBytes, 0);
+ 
+                    auto const alphaFirst = (eFormat == ScanlineFormat::N32BitTcAbgr
+                                             || eFormat == ScanlineFormat::N32BitTcArgb);
+                     for (int pass = 0; pass < nNumberOfPasses; pass++)
+                     {
+                         for (png_uint_32 y = 0; y < height; y++)
+@@ -199,10 +201,17 @@ bool reader(SvStream& rStream, BitmapEx& rBitmapEx, bool bUseBitmap32)
+                             for (size_t i = 0; i < aRowSizeBytes; i += 4)
+                             {
+                                 sal_Int8 alpha = pRow[i + 3];
+                                if (alphaFirst)
+                                {
+                                    pScanline[iColor++] = alpha;
+                                }
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 0], alpha);
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 1], alpha);
+                                 pScanline[iColor++] = vcl::bitmap::premultiply(pRow[i + 2], alpha);
+-                                pScanline[iColor++] = alpha;
+                                if (!alphaFirst)
+                                {
+                                    pScanline[iColor++] = alpha;
+                                }
+                             }
+                         }
+                     }
+-- 
+2.33.1
+
--- a/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
+++ b/SOURCES/0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
@ -0,0 +1,116 @@
+From 96b088a62174a70441ebe959495756e9d86203a2 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Thu, 24 Sep 2020 14:51:16 +0200
+Subject: [PATCH] Fix endianness issues in OOX crypto routines
+
+...without which CppunitTest_sw_ooxmlencryption failed on (big-endian) s390x:
+
+* The 32-bit segment counter in AgileEngine::de-/encrypt apparently needs to be
+  stored in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
+  ultimately succeeded, whereas otherwise it failed).
+
+* The UTF-16 string in Standard2007Engine::calculateEncryptionKey apparently
+  needs to be in LSB format (at least, if it is, CppunitTest_sw_ooxmlencryption
+  ultimately succeeded, whereas otherwise it failed).
+
+* The various 32-bit values in the EncryptionStandardHeader and
+  EncryptionVerifierAES data structures apparently need to be written out in LSB
+  format in Standard2007Engine::writeEncryptionInfo, given that they are always
+  read in LSB format in Standard2007Engine::readEncryptionInfo.
+
+Change-Id: I3a1efbfe324b1bbd539b88dc5d40bb44f9676ffa
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103315
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 646a69757b928aeaf6e0d0d41c4b30c02803a3a3)
+---
+ oox/source/crypto/AgileEngine.cxx        | 16 +++++++++-----
+ oox/source/crypto/Standard2007Engine.cxx | 28 +++++++++++++++++-------
+ 2 files changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/oox/source/crypto/AgileEngine.cxx b/oox/source/crypto/AgileEngine.cxx
+index 7c2a0e9c93d2..0fc972bf2ca5 100644
+--- a/oox/source/crypto/AgileEngine.cxx
+++ b/oox/source/crypto/AgileEngine.cxx
+@@ -457,9 +457,11 @@ bool AgileEngine::decrypt(BinaryXInputStream& aInputStream,
+ 
+     while ((inputLength = aInputStream.readMemory(inputBuffer.data(), inputBuffer.size())) > 0)
+     {
+-        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&segment);
+-        sal_uInt8* segmentEnd   = segmentBegin + sizeof(segment);
+-        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
+        auto p = saltWithBlockKey.begin() + saltSize;
+        p[0] = segment & 0xFF;
+        p[1] = (segment >> 8) & 0xFF;
+        p[2] = (segment >> 16) & 0xFF;
+        p[3] = segment >> 24;
+ 
+         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
+ 
+@@ -800,9 +802,11 @@ void AgileEngine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputS
+                         inputLength : oox::core::roundUp(inputLength, sal_uInt32(mInfo.blockSize));
+ 
+         // Update Key
+-        sal_uInt8* segmentBegin = reinterpret_cast<sal_uInt8*>(&nSegment);
+-        sal_uInt8* segmentEnd   = segmentBegin + nSegmentByteSize;
+-        std::copy(segmentBegin, segmentEnd, saltWithBlockKey.begin() + saltSize);
+        auto p = saltWithBlockKey.begin() + saltSize;
+        p[0] = nSegment & 0xFF;
+        p[1] = (nSegment >> 8) & 0xFF;
+        p[2] = (nSegment >> 16) & 0xFF;
+        p[3] = nSegment >> 24;
+ 
+         hashCalc(hash, saltWithBlockKey, mInfo.hashAlgorithm);
+ 
+diff --git a/oox/source/crypto/Standard2007Engine.cxx b/oox/source/crypto/Standard2007Engine.cxx
+index 38c4e03baf15..e96fc8f841f2 100644
+--- a/oox/source/crypto/Standard2007Engine.cxx
+++ b/oox/source/crypto/Standard2007Engine.cxx
+@@ -79,12 +79,12 @@ bool Standard2007Engine::calculateEncryptionKey(const OUString& rPassword)
+     std::vector<sal_uInt8> initialData(saltSize + passwordByteLength);
+     std::copy(saltArray, saltArray + saltSize, initialData.begin());
+ 
+-    const sal_uInt8* passwordByteArray = reinterpret_cast<const sal_uInt8*>(rPassword.getStr());
+-
+-    std::copy(
+-        passwordByteArray,
+-        passwordByteArray + passwordByteLength,
+-        initialData.begin() + saltSize);
+    auto p = initialData.begin() + saltSize;
+    for (sal_Int32 i = 0; i != rPassword.getLength(); ++i) {
+        auto c = rPassword[i];
+        *p++ = c & 0xFF;
+        *p++ = c >> 8;
+    }
+ 
+     // use "hash" vector for result of sha1 hashing
+     // calculate SHA1 hash of initialData
+@@ -223,11 +223,23 @@ void Standard2007Engine::writeEncryptionInfo(BinaryXOutputStream& rStream)
+     sal_uInt32 headerSize = encryptionHeaderSize + cspNameSize;
+     rStream.WriteUInt32(headerSize);
+ 
+-    rStream.writeMemory(&mInfo.header, encryptionHeaderSize);
+    rStream.WriteUInt32(mInfo.header.flags);
+    rStream.WriteUInt32(mInfo.header.sizeExtra);
+    rStream.WriteUInt32(mInfo.header.algId);
+    rStream.WriteUInt32(mInfo.header.algIdHash);
+    rStream.WriteUInt32(mInfo.header.keyBits);
+    rStream.WriteUInt32(mInfo.header.providedType);
+    rStream.WriteUInt32(mInfo.header.reserved1);
+    rStream.WriteUInt32(mInfo.header.reserved2);
+     rStream.writeUnicodeArray(lclCspName);
+     rStream.WriteUInt16(0);
+ 
+-    rStream.writeMemory(&mInfo.verifier, sizeof(msfilter::EncryptionVerifierAES));
+    rStream.WriteUInt32(mInfo.verifier.saltSize);
+    rStream.writeMemory(&mInfo.verifier.salt, sizeof mInfo.verifier.salt);
+    rStream.writeMemory(&mInfo.verifier.encryptedVerifier, sizeof mInfo.verifier.encryptedVerifier);
+    rStream.WriteUInt32(mInfo.verifier.encryptedVerifierHashSize);
+    rStream.writeMemory(
+        &mInfo.verifier.encryptedVerifierHash, sizeof mInfo.verifier.encryptedVerifierHash);
+ }
+ 
+ void Standard2007Engine::encrypt(css::uno::Reference<css::io::XInputStream> &  rxInputStream,
+-- 
+2.33.1
+
--- a/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
+++ b/SOURCES/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
@ -0,0 +1,80 @@
+From b66d735cf3dc8b80783cb161c0aff5b990db1bb0 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Thu, 16 Feb 2023 20:20:31 +0100
+Subject: [PATCH 1/3] Obtain actual 0-parameter count for OR(), AND() and
+ 1-parameter functions
+
+OR and AND for legacy infix notation are classified as binary
+operators but in fact are functions with parameter count. In case
+no argument is supplied, GetByte() returns 0 and for that case the
+implicit binary operator 2 parameters were wrongly assumed.
+Similar for functions expecting 1 parameter, without argument 1
+was assumed. For "real" unary and binary operators the compiler
+already checks parameters. Omit OR and AND and 1-parameter
+functions from this implicit assumption and return the actual 0
+count.
+
+Change-Id: Ie05398c112a98021ac2875cf7b6de994aee9d882
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147173
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+
+(cherry picked from commit e7ce9bddadb2db222eaa5f594ef1de2e36d57e5c)
+Conflicts:
+        sc/source/core/tool/interpr4.cxx
+---
+ formula/source/core/api/token.cxx | 13 +++++--------
+ sc/source/core/tool/interpr4.cxx  | 10 +++++++++-
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
+index 17594207234f..0db0c3464610 100644
+--- a/formula/source/core/api/token.cxx
+++ b/formula/source/core/api/token.cxx
+@@ -95,17 +95,14 @@ sal_uInt8 FormulaToken::GetParamCount() const
+         return 0;       // parameters and specials
+                         // ocIf... jump commands not for FAP, have cByte then
+ //2do: bool parameter whether FAP or not?
+-    else if ( GetByte() )
+    else if (GetByte())
+         return GetByte();   // all functions, also ocExternal and ocMacro
+-    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP)
+-        return 2;           // binary
+-    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP)
+-            || eOp == ocPercentSign)
+-        return 1;           // unary
+    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP && eOp != ocAnd && eOp != ocOr)
+        return 2;           // binary operators, compiler checked; OR and AND legacy but are functions
+    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP) || eOp == ocPercentSign)
+        return 1;           // unary operators, compiler checked
+     else if (SC_OPCODE_START_NO_PAR <= eOp && eOp < SC_OPCODE_STOP_NO_PAR)
+         return 0;           // no parameter
+-    else if (SC_OPCODE_START_1_PAR <= eOp && eOp < SC_OPCODE_STOP_1_PAR)
+-        return 1;           // one parameter
+     else if (FormulaCompiler::IsOpCodeJumpCommand( eOp ))
+         return 1;           // only the condition counts as parameter
+     else
+diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
+index eb3fb987c034..94235c33eaef 100644
+--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
+@@ -4012,7 +4012,15 @@ StackVar ScInterpreter::Interpret()
+                 else if (sp >= pCur->GetParamCount())
+                     nStackBase = sp - pCur->GetParamCount();
+                 else
+-                    nStackBase = sp;    // underflow?!?
+                {
+                    SAL_WARN("sc.core", "Stack anomaly at " << aPos.Format(
+                                ScRefFlags::VALID | ScRefFlags::FORCE_DOC | ScRefFlags::TAB_3D, pDok)
+                            << "  eOp: " << static_cast<int>(eOp)
+                            << "  params: " << static_cast<int>(pCur->GetParamCount())
+                            << "  nStackBase: " << nStackBase << "  sp: " << sp);
+                    nStackBase = sp;
+                    assert(!"underflow");
+                }
+             }
+ 
+             switch( eOp )
+-- 
+2.41.0
+
--- a/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
+++ b/SOURCES/0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
@ -0,0 +1,59 @@
+From 9f393ee10ae198063bbe3b71c2c87262e7880a34 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Wed, 23 Sep 2020 11:53:11 +0200
+Subject: [PATCH] Read MOSDocumentLockFile UTF-16 string data with same
+ endianness
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+...as MSODocumentLockFile::WriteEntryToStream has written it to (i.e.,
+always as UTF-16LE, assuming that is actually the right format to use).  The
+discrepancy between writing and reading the string data appears to be present
+ever since the code's introduction in 5db1e20b8b0942dac2d50f3cd34532bb61147020
+"Introduce new lockfile handler for MSO like lockfiles".
+
+This caused CppunitTest_svl_lockfiles to fail on (big-endian) s390x Linux with
+
+> svl/qa/unit/lockfiles/test_lockfiles.cxx:578:(anonymous namespace)::LockfileTest::testWordLockFileRT
+> equality assertion failed
+> - Expected: LockFile Test
+> - Actual  : 䰀漀挀欀䘀椀氀攀 吀攀猀琀
+
+etc.
+
+Change-Id: I97267aa14a3a926e7fd7bb1d2ce7d2de05d52a64
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103238
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit 1b9fa11a0869246fe0433b79aab30dd216cf92b6)
+---
+ svl/source/misc/msodocumentlockfile.cxx | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/svl/source/misc/msodocumentlockfile.cxx b/svl/source/misc/msodocumentlockfile.cxx
+index 9650db03999f..0c857ffb53ec 100644
+--- a/svl/source/misc/msodocumentlockfile.cxx
+++ b/svl/source/misc/msodocumentlockfile.cxx
+@@ -228,8 +228,16 @@ LockFileEntry MSODocumentLockFile::GetLockData()
+                 nUTF16Len = *++pBuf; // use Excel/PowerPoint position
+ 
+             if (nUTF16Len > 0 && nUTF16Len <= 52) // skip wrong format
+-                aResult[LockFileComponent::OOOUSERNAME]
+-                    = OUString(reinterpret_cast<const sal_Unicode*>(pBuf + 2), nUTF16Len);
+            {
+                OUStringBuffer str(nUTF16Len);
+                sal_uInt8 const* p = reinterpret_cast<sal_uInt8 const*>(pBuf + 2);
+                for (int i = 0; i != nUTF16Len; ++i)
+                {
+                    str.append(sal_Unicode(p[0] | (sal_uInt32(p[1]) << 8)));
+                    p += 2;
+                }
+                aResult[LockFileComponent::OOOUSERNAME] = str.makeStringAndClear();
+            }
+         }
+     }
+     return aResult;
+-- 
+2.33.1
+
--- a/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
+++ b/SOURCES/0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
@ -0,0 +1,72 @@
+From 5c705fbd9e4d231fed87b7e8ac06d8b7d4c6891f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 12 Aug 2021 12:55:30 +0100
+Subject: [PATCH] Resolves: tdf#132739 two style tags where there should be
+ just one
+
+Change-Id: Id9c8c8cc8c5ffdd21ba79ff39a6279cf2ddc8025
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120360
+Tested-by: Jenkins
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+---
+ sw/source/filter/html/css1atr.cxx  | 4 +++-
+ sw/source/filter/html/htmltabw.cxx | 9 ++++++---
+ sw/source/filter/html/wrthtml.hxx  | 2 +-
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sw/source/filter/html/css1atr.cxx b/sw/source/filter/html/css1atr.cxx
+index 7b1a5cc19be3..c401d95a788f 100644
+--- a/sw/source/filter/html/css1atr.cxx
+++ b/sw/source/filter/html/css1atr.cxx
+@@ -2113,10 +2113,12 @@ void SwHTMLWriter::OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameF
+         Strm().WriteChar( '\"' );
+ }
+ 
+-void SwHTMLWriter::OutCSS1_TableCellBorderHack(SwFrameFormat const& rFrameFormat)
+void SwHTMLWriter::OutCSS1_TableCellBordersAndBG(SwFrameFormat const& rFrameFormat, const SvxBrushItem *pBrushItem)
+ {
+     SwCSS1OutMode const aMode( *this,
+         CSS1_OUTMODE_STYLE_OPT_ON|CSS1_OUTMODE_ENCODE|CSS1_OUTMODE_TABLEBOX, nullptr );
+    if (pBrushItem)
+        OutCSS1_SvxBrush(*this, *pBrushItem, Css1Background::Table, nullptr);
+     OutCSS1_SvxBox(*this, rFrameFormat.GetBox());
+     if (!m_bFirstCSS1Property)
+     {
+diff --git a/sw/source/filter/html/htmltabw.cxx b/sw/source/filter/html/htmltabw.cxx
+index 4c83319747b7..63812a9b3ef6 100644
+--- a/sw/source/filter/html/htmltabw.cxx
+++ b/sw/source/filter/html/htmltabw.cxx
+@@ -424,11 +424,14 @@ void SwHTMLWrtTable::OutTableCell( SwHTMLWriter& rWrt,
+             // Avoid non-CSS version in the ReqIF case.
+             rWrt.OutBackground( pBrushItem, false );
+ 
+-        if( rWrt.m_bCfgOutStyles )
+-            OutCSS1_TableBGStyleOpt( rWrt, *pBrushItem );
+        if (!rWrt.m_bCfgOutStyles)
+            pBrushItem = nullptr;
+     }
+ 
+-    rWrt.OutCSS1_TableCellBorderHack(*pBox->GetFrameFormat());
+    // tdf#132739 with rWrt.m_bCfgOutStyles of true bundle the brush item css
+    // properties into the same "style" tag as the borders so there is only one
+    // style tag
+    rWrt.OutCSS1_TableCellBordersAndBG(*pBox->GetFrameFormat(), pBrushItem);
+ 
+     sal_uInt32 nNumFormat = 0;
+     double nValue = 0.0;
+diff --git a/sw/source/filter/html/wrthtml.hxx b/sw/source/filter/html/wrthtml.hxx
+index ab282ba652ff..f82325ee50ae 100644
+--- a/sw/source/filter/html/wrthtml.hxx
+++ b/sw/source/filter/html/wrthtml.hxx
+@@ -484,7 +484,7 @@ public:
+     void writeFrameFormatOptions(HtmlWriter& aHtml, const SwFrameFormat& rFrameFormat, const OUString& rAltText, HtmlFrmOpts nFrameOpts);
+ 
+     void OutCSS1_TableFrameFormatOptions( const SwFrameFormat& rFrameFormat );
+-    void OutCSS1_TableCellBorderHack(const SwFrameFormat& rFrameFormat);
+    void OutCSS1_TableCellBordersAndBG(const SwFrameFormat& rFrameFormat, const SvxBrushItem *pBrushItem);
+     void OutCSS1_SectionFormatOptions( const SwFrameFormat& rFrameFormat, const SwFormatCol *pCol );
+     void OutCSS1_FrameFormatOptions( const SwFrameFormat& rFrameFormat, HtmlFrmOpts nFrameOpts,
+                                      const SdrObject *pSdrObj=nullptr,
+-- 
+2.31.1
+
--- a/SOURCES/0001-backports-to-ease-CVE-backporting.patch
+++ b/SOURCES/0001-backports-to-ease-CVE-backporting.patch
@ -0,0 +1,259 @@
+From c2cf13da3bbf756ef3f78251c40d45fc23c27f36 Mon Sep 17 00:00:00 2001
+From: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
+Date: Wed, 29 Apr 2020 07:42:24 +0200
+Subject: [PATCH 1/6] backports to ease CVE backporting
+
+Remove unnecessary if block
+
+And format code inside
+
+Change-Id: Ied0d98935134bf6f7bc8c929645ad5faac9affa3
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93116
+Tested-by: Jenkins
+Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
+(cherry picked from commit cf36fe5eb41910c26d58fb25e54ccf2e0ee01365)
+
+space out the namespace constant values
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/88938
+(cherry picked from commit 5352d45dd4a04f8f02cf7f6ad4169126d3b3586a)
+
+Change-Id: I30f54bfc1389e91b18e4fee8b83e1b297419899b
+---
+ include/xmloff/xmlnmspe.hxx                   |  16 +--
+ .../component/documentdigitalsignatures.cxx   | 130 +++++++++---------
+ .../source/helper/xmlsignaturehelper.cxx      |   1 +
+ 3 files changed, 75 insertions(+), 72 deletions(-)
+
+diff --git a/include/xmloff/xmlnmspe.hxx b/include/xmloff/xmlnmspe.hxx
+index a00628b6b999..b079053c38d3 100644
+--- a/include/xmloff/xmlnmspe.hxx
+++ b/include/xmloff/xmlnmspe.hxx
+@@ -69,7 +69,7 @@ XML_NAMESPACE( XML_NAMESPACE_VERSIONS_LIST,   37U )
+ 
+ // namespaces for odf extended formats
+ 
+-#define XML_NAMESPACE_EXT_BASE 38U
+#define XML_NAMESPACE_EXT_BASE 50U
+ #define XML_NAMESPACE_EXT( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_EXT_BASE+index);
+ 
+@@ -82,7 +82,7 @@ XML_NAMESPACE_EXT( XML_NAMESPACE_LO_EXT,           5U )
+ 
+ // namespaces for OOo formats
+ 
+-#define XML_NAMESPACE_OOO_BASE 44U
+#define XML_NAMESPACE_OOO_BASE 60U
+ #define XML_NAMESPACE_OOO( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_OOO_BASE+index);
+ 
+@@ -100,7 +100,7 @@ XML_NAMESPACE_OOO( XML_NAMESPACE_CONFIG_OOO,        10U )
+ XML_NAMESPACE_OOO( XML_NAMESPACE_FORM_OOO,          11U )
+ XML_NAMESPACE_OOO( XML_NAMESPACE_SCRIPT_OOO,        12U )
+ 
+-#define XML_NAMESPACE_COMPAT_BASE 57U
+#define XML_NAMESPACE_COMPAT_BASE 80U
+ #define XML_NAMESPACE_COMPAT( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_COMPAT_BASE+index);
+ 
+@@ -108,14 +108,14 @@ XML_NAMESPACE_COMPAT( XML_NAMESPACE_SVG_COMPAT,      0U )
+ XML_NAMESPACE_COMPAT( XML_NAMESPACE_FO_COMPAT,       1U )
+ XML_NAMESPACE_COMPAT( XML_NAMESPACE_SMIL_COMPAT,     2U )
+ 
+-#define XML_NAMESPACE_OASIS_BASE 60U
+#define XML_NAMESPACE_OASIS_BASE 90U
+ #define XML_NAMESPACE_OASIS( prefix, index ) \
+ const sal_uInt16 prefix = (XML_NAMESPACE_OASIS_BASE+index);
+ 
+ XML_NAMESPACE_OASIS( XML_NAMESPACE_DB_OASIS,         0U )
+ XML_NAMESPACE_OASIS( XML_NAMESPACE_REPORT_OASIS,     1U )
+ 
+-#define XML_OLD_NAMESPACE_BASE 62U
+#define XML_OLD_NAMESPACE_BASE 100U
+ #define XML_OLD_NAMESPACE( prefix, index ) \
+ const sal_uInt16 prefix = (XML_OLD_NAMESPACE_BASE+index);
+ 
+@@ -134,9 +134,9 @@ XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_CHART,         10U )
+ XML_OLD_NAMESPACE( XML_OLD_NAMESPACE_SMIL,          11U )
+ 
+ // experimental namespaces
+-XML_NAMESPACE( XML_NAMESPACE_FIELD,           100U )
+-XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        103U )  // CSS Text Level 3
+-XML_NAMESPACE( XML_NAMESPACE_FORMX,           101U )  // form interop extensions
+XML_NAMESPACE( XML_NAMESPACE_FIELD,           120U )
+XML_NAMESPACE( XML_NAMESPACE_CSS3TEXT,        123U )  // CSS Text Level 3
+XML_NAMESPACE( XML_NAMESPACE_FORMX,           121U )  // form interop extensions
+ 
+ 
+ #endif // INCLUDED_XMLOFF_XMLNMSPE_HXX
+diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+index dcfaad0af773..52cb938a8e0a 100644
+--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
+@@ -500,85 +500,87 @@ DocumentDigitalSignatures::ImplVerifySignatures(
+     Sequence< css::security::DocumentSignatureInformation > aInfos(nInfos);
+     css::security::DocumentSignatureInformation* arInfos = aInfos.getArray();
+ 
+-    if ( nInfos )
+    for (int n = 0; n < nInfos; ++n)
+     {
+-        for( int n = 0; n < nInfos; ++n )
+-        {
+-            DocumentSignatureAlgorithm mode = DocumentSignatureHelper::getDocumentAlgorithm(
+-                m_sODFVersion, aSignInfos[n]);
+-            const std::vector< OUString > aElementsToBeVerified =
+-                DocumentSignatureHelper::CreateElementList(
+-                rxStorage, eMode, mode);
+        DocumentSignatureAlgorithm mode
+            = DocumentSignatureHelper::getDocumentAlgorithm(m_sODFVersion, aSignInfos[n]);
+        const std::vector<OUString> aElementsToBeVerified
+            = DocumentSignatureHelper::CreateElementList(rxStorage, eMode, mode);
+ 
+-            const SignatureInformation& rInfo = aSignInfos[n];
+-            css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
+        const SignatureInformation& rInfo = aSignInfos[n];
+        css::security::DocumentSignatureInformation& rSigInfo = arInfos[n];
+ 
+-            if (rInfo.ouGpgCertificate.isEmpty()) // X.509
+        if (rInfo.ouGpgCertificate.isEmpty()) // X.509
+        {
+            if (!rInfo.ouX509Certificate.isEmpty())
+                rSigInfo.Signer = xSecEnv->createCertificateFromAscii(rInfo.ouX509Certificate);
+            if (!rSigInfo.Signer.is())
+                rSigInfo.Signer = xSecEnv->getCertificate(
+                    rInfo.ouX509IssuerName,
+                    xmlsecurity::numericStringToBigInteger(rInfo.ouX509SerialNumber));
+
+            // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
+            // to find the parent certificate. It does not take into account that there can be several certificates
+            // with the same subject name.
+            try
+             {
+-                if (!rInfo.ouX509Certificate.isEmpty())
+-                    rSigInfo.Signer = xSecEnv->createCertificateFromAscii( rInfo.ouX509Certificate ) ;
+-                if (!rSigInfo.Signer.is())
+-                    rSigInfo.Signer = xSecEnv->getCertificate( rInfo.ouX509IssuerName,
+-                                                               xmlsecurity::numericStringToBigInteger( rInfo.ouX509SerialNumber ) );
+-
+-                // On Windows checking the certificate path is buggy. It does name matching (issuer, subject name)
+-                // to find the parent certificate. It does not take into account that there can be several certificates
+-                // with the same subject name.
+-
+-                try {
+-                    rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(rSigInfo.Signer,
+-                                                                            Sequence<Reference<css::security::XCertificate> >());
+-                } catch (SecurityException& ) {
+-                    OSL_FAIL("Verification of certificate failed");
+-                    rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
+-                }
+                rSigInfo.CertificateStatus = xSecEnv->verifyCertificate(
+                    rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
+             }
+-            else if (xGpgSecEnv.is()) // GPG
+            catch (SecurityException&)
+             {
+-                // TODO not ideal to retrieve cert by keyID, might
+-                // collide, or PGPKeyID format might change - can't we
+-                // keep the xCert itself in rInfo?
+-                rSigInfo.Signer = xGpgSecEnv->getCertificate( rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger("") );
+-                rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(rSigInfo.Signer,
+-                                                                           Sequence<Reference<css::security::XCertificate> >());
+                OSL_FAIL("Verification of certificate failed");
+                rSigInfo.CertificateStatus = css::security::CertificateValidity::INVALID;
+             }
+        }
+        else if (xGpgSecEnv.is()) // GPG
+        {
+            // TODO not ideal to retrieve cert by keyID, might
+            // collide, or PGPKeyID format might change - can't we
+            // keep the xCert itself in rInfo?
+            rSigInfo.Signer = xGpgSecEnv->getCertificate(
+                rInfo.ouGpgKeyID, xmlsecurity::numericStringToBigInteger(""));
+            rSigInfo.CertificateStatus = xGpgSecEnv->verifyCertificate(
+                rSigInfo.Signer, Sequence<Reference<css::security::XCertificate>>());
+        }
+ 
+-            // Time support again (#i38744#)
+-            Date aDate( rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year );
+-            tools::Time aTime( rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
+-                        rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds );
+-            rSigInfo.SignatureDate = aDate.GetDate();
+-            rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
+        // Time support again (#i38744#)
+        Date aDate(rInfo.stDateTime.Day, rInfo.stDateTime.Month, rInfo.stDateTime.Year);
+        tools::Time aTime(rInfo.stDateTime.Hours, rInfo.stDateTime.Minutes,
+                          rInfo.stDateTime.Seconds, rInfo.stDateTime.NanoSeconds);
+        rSigInfo.SignatureDate = aDate.GetDate();
+        rSigInfo.SignatureTime = aTime.GetTime() / tools::Time::nanoPerCenti;
+ 
+-            rSigInfo.SignatureIsValid = ( rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED );
+        rSigInfo.SignatureIsValid
+            = (rInfo.nStatus == css::xml::crypto::SecurityOperationStatus_OPERATION_SUCCEEDED);
+ 
+-            // Signature line info (ID + Images)
+-            if (!rInfo.ouSignatureLineId.isEmpty())
+-                rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
+        // Signature line info (ID + Images)
+        if (!rInfo.ouSignatureLineId.isEmpty())
+            rSigInfo.SignatureLineId = rInfo.ouSignatureLineId;
+ 
+-            if (rInfo.aValidSignatureImage.is())
+-                rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
+        if (rInfo.aValidSignatureImage.is())
+            rSigInfo.ValidSignatureLineImage = rInfo.aValidSignatureImage;
+ 
+-            if (rInfo.aInvalidSignatureImage.is())
+-                rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
+-
+-            // OOXML intentionally doesn't sign metadata.
+-            if ( rSigInfo.SignatureIsValid && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
+-            {
+-                 rSigInfo.SignatureIsValid =
+-                      DocumentSignatureHelper::checkIfAllFilesAreSigned(
+-                      aElementsToBeVerified, rInfo, mode);
+-            }
+-            if (eMode == DocumentSignatureMode::Content)
+-            {
+-                if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
+-                    rSigInfo.PartialDocumentSignature = true;
+-                else
+-                    rSigInfo.PartialDocumentSignature = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
+-            }
+        if (rInfo.aInvalidSignatureImage.is())
+            rSigInfo.InvalidSignatureLineImage = rInfo.aInvalidSignatureImage;
+ 
+        // OOXML intentionally doesn't sign metadata.
+        if (rSigInfo.SignatureIsValid
+            && aStreamHelper.nStorageFormat != embed::StorageFormats::OFOPXML)
+        {
+            rSigInfo.SignatureIsValid = DocumentSignatureHelper::checkIfAllFilesAreSigned(
+                aElementsToBeVerified, rInfo, mode);
+        }
+        if (eMode == DocumentSignatureMode::Content)
+        {
+            if (aStreamHelper.nStorageFormat == embed::StorageFormats::OFOPXML)
+                rSigInfo.PartialDocumentSignature = true;
+            else
+                rSigInfo.PartialDocumentSignature
+                    = !DocumentSignatureHelper::isOOo3_2_Signature(aSignInfos[n]);
+         }
+     }
+
+     return aInfos;
+ 
+ }
+diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+index 6ec834053a17..22c056e70da1 100644
+--- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+@@ -402,6 +402,7 @@ bool XMLSignatureHelper::ReadAndVerifySignatureStorageStream(const css::uno::Ref
+     catch(const uno::Exception&)
+     {
+         DBG_UNHANDLED_EXCEPTION("xmlsecurity.helper");
+        mbError = true;
+     }
+ 
+     mpXSecController->releaseSignatureReader();
+-- 
+2.32.0
+
--- a/SOURCES/0001-disable-script-dump.patch
+++ b/SOURCES/0001-disable-script-dump.patch
@ -0,0 +1,99 @@
+From ff68c22161071ce89851c6d81e80ba51b67e8e0c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 13 Feb 2023 13:56:10 +0000
+Subject: [PATCH] disable script dump
+
+Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986
+Tested-by: Jenkins
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051
+Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147255
+Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
+Reviewed-by: Andras Timar <andras.timar@collabora.com>
+(cherry picked from commit ae3a7dcbb60bb73700737b9ca8940ce3103648d9)
+---
+ .../source/drivers/hsqldb/HDriver.cxx         | 31 +++++++++++++++++++
+ external/hsqldb/UnpackedTarball_hsqldb.mk     |  1 +
+ .../hsqldb/patches/disable-dump-script.patch  | 14 +++++++++
+ 3 files changed, 46 insertions(+)
+ create mode 100644 external/hsqldb/patches/disable-dump-script.patch
+
+diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx
+index de76ecbba29de..95c610843efab 100644
+--- a/connectivity/source/drivers/hsqldb/HDriver.cxx
+++ b/connectivity/source/drivers/hsqldb/HDriver.cxx
+@@ -300,6 +300,37 @@ namespace connectivity
+                         } // if ( xStream.is() )
+                         ::comphelper::disposeComponent(xStream);
+                     }
+
+                    // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces
+                    // in that bundled hsqldb 1.8.0 is patched to also reject them)
+                    //
+                    // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data
+                    // which seems to provide a builtin way to do this with contemporary hsqldb
+                    const OUString sScript( "script" );
+                    if (!bIsNewDatabase && xStorage->isStreamElement(sScript))
+                    {
+                        Reference<XStream > xStream = xStorage->openStreamElement(sScript, ElementModes::READ);
+                        if (xStream.is())
+                        {
+                            std::unique_ptr<SvStream> pStream(::utl::UcbStreamHelper::CreateStream(xStream));
+                            if (pStream)
+                            {
+                                OString sLine;
+                                while (pStream->ReadLine(sLine))
+                                {
+                                    OString sText = sLine.trim();
+                                    if (sText.startsWithIgnoreAsciiCase("SCRIPT"))
+                                    {
+                                        ::connectivity::SharedResources aResources;
+                                        sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath);
+                                        break;
+                                    }
+                                }
+                            }
+                        } // if ( xStream.is() )
+                        ::comphelper::disposeComponent(xStream);
+                    }
+
+                 }
+                 catch(Exception&)
+                 {
+diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk
+index cbba770f19a07..ed262cccf4caa 100644
+--- a/external/hsqldb/UnpackedTarball_hsqldb.mk
+++ b/external/hsqldb/UnpackedTarball_hsqldb.mk
+@@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\
+ 		external/hsqldb/patches/jdbc-4.1.patch \
+ 		external/hsqldb/patches/multipleResultSets.patch \
+ 	) \
+	external/hsqldb/patches/disable-dump-script.patch \
+ ))
+ 
+ # vim: set noet sw=4 ts=4:
+diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch
+new file mode 100644
+index 0000000000000..401dd38abc9a2
+--- /dev/null
+++ b/external/hsqldb/patches/disable-dump-script.patch
+@@ -0,0 +1,14 @@
+--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 11:08:11.297243034 +0000
++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 13:49:17.973089433 +0000
+@@ -403,6 +403,11 @@
+                     throw Trace.error(Trace.INVALID_IDENTIFIER);
+                 }
+ 
++                // added condition to avoid execution of spurious command in .script or .log file
++                if (session.isProcessingScript() || session.isProcessingLog()) {
++                    return new Result(ResultConstants.UPDATECOUNT);
++                }
++
+                 dsw = new ScriptWriterText(database, token, true, true, true);
+ 
+                 dsw.writeAll();
+-- 
+2.41.0
+
--- a/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
+++ b/SOURCES/0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
@ -0,0 +1,82 @@
+From 8bfdd84ffcffe19aa6c495a0772e1a5fcb9a5124 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Fri, 25 Sep 2020 11:22:03 +0100
+Subject: [PATCH] rhbz#1882616 move cursor one step at a time in the desired
+ direction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+until we get to the target position. The break iterator operates in graphemes
+so we can't just move Left/Right the amount of utf-16 we want to move.
+
+Change-Id: I25d4e9285deae374f85dcaadbf4601bc213a89de
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103380
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit bf858622e543163a23db766912ea6b121f447e6d)
+---
+ sw/source/core/edit/editsh.cxx | 40 +++++++++++++++++++++++++++++-----
+ 1 file changed, 35 insertions(+), 5 deletions(-)
+
+diff --git a/sw/source/core/edit/editsh.cxx b/sw/source/core/edit/editsh.cxx
+index 8f84ce42ed75..872d92d7afcc 100644
+--- a/sw/source/core/edit/editsh.cxx
+++ b/sw/source/core/edit/editsh.cxx
+@@ -988,7 +988,8 @@ OUString SwEditShell::DeleteExtTextInput( bool bInsText )
+ 
+ void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
+ {
+-    const SwPosition& rPos = *GetCursor()->GetPoint();
+    SwPaM* pCurrentCursor = GetCursor();
+    const SwPosition& rPos = *pCurrentCursor->GetPoint();
+     SwExtTextInput* pInput = GetDoc()->GetExtTextInput( rPos.nNode.GetNode() );
+     if( !pInput )
+         return;
+@@ -1005,10 +1006,39 @@ void SwEditShell::SetExtTextInputData( const CommandExtTextInputData& rData )
+     // ugly but works
+     ShowCursor();
+     const sal_Int32 nDiff = nNewCursorPos - rPos.nContent.GetIndex();
+-    if( 0 > nDiff )
+-        Left( -nDiff, CRSR_SKIP_CHARS );
+-    else if( 0 < nDiff )
+-        Right( nDiff, CRSR_SKIP_CHARS );
+    if( nDiff != 0)
+    {
+        bool bLeft = nDiff < 0;
+        sal_Int32 nMaxGuard = std::abs(nDiff);
+        while (true)
+        {
+            auto nOldPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
+            if (bLeft)
+                Left(1, CRSR_SKIP_CHARS);
+            else
+                Right(1, CRSR_SKIP_CHARS);
+            auto nNewPos = pCurrentCursor->GetPoint()->nContent.GetIndex();
+
+            // expected success
+            if (nNewPos == nNewCursorPos)
+                break;
+
+            if (nNewPos == nOldPos)
+            {
+                // if there was no movement, we have failed for some reason
+                SAL_WARN("sw.core", "IM cursor move failed");
+                break;
+            }
+
+            if (--nMaxGuard == 0)
+            {
+                // if it takes more cursor moves than there are utf-16 chars to move past
+                // something has probably gone wrong
+                SAL_WARN("sw.core", "IM abandoning cursor positioning");
+                break;
+            }
+        }
+    }
+ 
+     SetOverwriteCursor( rData.IsCursorOverwrite() );
+ 
+-- 
+2.29.2
+
--- a/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
+++ b/SOURCES/0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
@ -0,0 +1,491 @@
+From b49380bd288e642352cb7ddc1c050e2fb34b5b43 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 13 Jul 2021 12:38:07 +0100
+Subject: [PATCH] rhbz#1980800 allow --convert-to csv to write each sheet to a
+ separate file
+
+Related: tdf#135762 except only currently implemented for command line use
+
+sample usage:
+soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,-1 sample.ods
+where the new (11th!) final token ("-1") enables writing each sheet to a
+new file based on the suggested target name so output in this example
+is files sample-Sheet1.csv and sample-Sheet2.csv
+
+Only -1 for 'all sheets' vs 0 for existing 'current sheet only' (which
+is always sheet 0 from the command line) are currently options but the
+token could be expanded in the future to select specific sheets to
+export.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118850
+Tested-by: Jenkins
+Reviewed-by: Eike Rathke <erack@redhat.com>
+(cherry picked from commit b8903bc106dad036acb3d117e5c4fc955697fe02)
+
+Related: tdf#135762 Allow --convert-to csv to specify 1-based sheet number
+
+Same multifile mechanism as for -1 all sheets is used, so
+
+soffice --convert-to csv:"Text - txt - csv (StarCalc)":44,34,UTF8,1,,0,false,true,false,false,false,2 sample.ods
+
+writes a file sample-Sheet2.csv
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118971
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit fda91f8be16ba760e360940ebafd6244c648cb8c)
+
+Related: tdf#135762 Suppress cout if not command line
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119294
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 0cda081c9aa3b3dcb363f97bac60c845ce9a13e0)
+
+Change-Id: Ib99a120f1a2c8d1008a7a3c59a6b39f572fb346e
+b9248c9561e4e340c88458ac5dfd159e443a4cfd
+9431221aadf97739bb197871f25fa151ef4c391c
+
+Plus follow-up fix
+<https://git.libreoffice.org/core/+/d768757872ad25219fa291acd623ab98924acaaa%5E%21>
+"tdf#129829 sfx2: fix handling of password to open vs modify" (which happens to
+also fix saving to smb shares, in addition to the Windows-specific issue it was
+originally meant to fix), plus the relevant parts of its preceding
+<https://git.libreoffice.org/core/+/037cd13af81f8a1169d01e95036ed942f261f9a6%5E%21>
+"sw reqif-xhtml export: add a new RTFOLEMimeType parameter" introducing
+SfxMedium::SetArgs.
+---
+ desktop/source/app/dispatchwatcher.cxx |  50 +++++++--
+ include/sfx2/docfile.hxx               |   2 +
+ sc/source/ui/dbgui/imoptdlg.cxx        |  16 ++-
+ sc/source/ui/docshell/docsh.cxx        | 141 +++++++++++++++++++++----
+ sc/source/ui/inc/docsh.hxx             |   2 +-
+ sc/source/ui/inc/imoptdlg.hxx          |   6 +-
+ sfx2/source/doc/docfile.cxx            |  13 +++
+ 7 files changed, 194 insertions(+), 36 deletions(-)
+
+diff --git a/desktop/source/app/dispatchwatcher.cxx b/desktop/source/app/dispatchwatcher.cxx
+index 04140173c6d1..a5365da618e8 100644
+--- a/desktop/source/app/dispatchwatcher.cxx
+++ b/desktop/source/app/dispatchwatcher.cxx
+@@ -30,6 +30,7 @@
+ #include "dispatchwatcher.hxx"
+ #include <rtl/ustring.hxx>
+ #include <comphelper/processfactory.hxx>
+#include <comphelper/string.hxx>
+ #include <comphelper/synchronousdispatch.hxx>
+ #include <com/sun/star/io/IOException.hpp>
+ #include <com/sun/star/util/XCloseable.hpp>
+@@ -604,6 +605,8 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                                 aFilter = impl_GuessFilter( aOutFile, aDocService );
+                             }
+ 
+                            bool bMultiFileTarget = false;
+
+                             if (aFilter.isEmpty())
+                             {
+                                 std::cerr << "Error: no export filter" << std::endl;
+@@ -611,29 +614,54 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                             else
+                             {
+                                 sal_Int32 nFilterOptionsIndex = aFilter.indexOf(':');
+-                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 3 : 2;
+                                sal_Int32 nProps = ( 0 < nFilterOptionsIndex ) ? 4 : 3;
+ 
+                                 if ( !aImgOut.isEmpty() )
+                                     nProps +=1;
+                                 Sequence<PropertyValue> conversionProperties( nProps );
+-                                conversionProperties[0].Name = "Overwrite";
+-                                conversionProperties[0].Value <<= true;
+                                conversionProperties[0].Name = "ConversionRequestOrigin";
+                                conversionProperties[0].Value <<= OUString("CommandLine");
+                                conversionProperties[1].Name = "Overwrite";
+                                conversionProperties[1].Value <<= true;
+ 
+-                                conversionProperties[1].Name = "FilterName";
+                                conversionProperties[2].Name = "FilterName";
+                                 if( 0 < nFilterOptionsIndex )
+                                 {
+-                                    conversionProperties[1].Value <<= aFilter.copy(0, nFilterOptionsIndex);
+                                    OUString sFilterName = aFilter.copy(0, nFilterOptionsIndex);
+                                    OUString sFilterOptions = aFilter.copy(nFilterOptionsIndex + 1);
+
+                                    if (sFilterName == "Text - txt - csv (StarCalc)")
+                                    {
+                                        sal_Int32 nIdx(0);
+                                        // If the 11th token is '-1' then we export a file
+                                        // per sheet where the file name is based on the suggested
+                                        // output filename concatenated with the sheet name, so adjust
+                                        // the output and overwrite messages
+                                        // If the 11th token is not present or numeric 0 then the
+                                        // default sheet is exported with the output filename. If it
+                                        // is numeric >0 then that sheet (1-based) with the output
+                                        // filename concatenated with the sheet name. So even if
+                                        // that is a single file, the multi file target mechanism is
+                                        // used.
+                                        const OUString aTok(sFilterOptions.getToken(11, ',', nIdx));
+                                        // Actual validity is checked in Calc, here just check for
+                                        // presence of numeric value at start.
+                                        bMultiFileTarget = (!aTok.isEmpty() && aTok.toInt32() != 0);
+                                    }
+
+                                    conversionProperties[2].Value <<= sFilterName;
+ 
+-                                    conversionProperties[2].Name = "FilterOptions";
+-                                    conversionProperties[2].Value <<= aFilter.copy(nFilterOptionsIndex + 1);
+                                    conversionProperties[3].Name = "FilterOptions";
+                                    conversionProperties[3].Value <<= sFilterOptions;
+                                 }
+                                 else
+                                 {
+-                                    conversionProperties[1].Value <<= aFilter;
+                                    conversionProperties[2].Value <<= aFilter;
+                                 }
+ 
+                                 if ( !aImgOut.isEmpty() )
+                                 {
+                                    assert(conversionProperties[nProps-1].Name.isEmpty());
+                                     conversionProperties[nProps-1].Name = "ImageFilter";
+                                     conversionProperties[nProps-1].Value <<= aImgOut;
+                                 }
+@@ -645,9 +673,11 @@ bool DispatchWatcher::executeDispatchRequests( const std::vector<DispatchRequest
+                                 OString aTargetURL8 = OUStringToOString(aTempName, osl_getThreadTextEncoding());
+                                 if (aDispatchRequest.aRequestType != REQUEST_CAT)
+                                 {
+-                                    std::cout << "convert " << aSource8 << " -> " << aTargetURL8;
+                                    std::cout << "convert " << aSource8;
+                                    if (!bMultiFileTarget)
+                                        std::cout << " -> " << aTargetURL8;
+                                     std::cout << " using filter : " << OUStringToOString(aFilter, osl_getThreadTextEncoding()) << std::endl;
+-                                    if (FStatHelper::IsDocument(aOutFile))
+                                    if (!bMultiFileTarget && FStatHelper::IsDocument(aOutFile))
+                                         std::cout << "Overwriting: " << OUStringToOString(aTempName, osl_getThreadTextEncoding()) << std::endl ;
+                                 }
+                                 try
+diff --git a/include/sfx2/docfile.hxx b/include/sfx2/docfile.hxx
+index 2019b5738c01..2886348 100644
+--- a/include/sfx2/docfile.hxx
+++ b/include/sfx2/docfile.hxx
+@@ -108,6 +108,8 @@ public:
+     const OUString&     GetOrigURL() const;
+ 
+     SfxItemSet  *       GetItemSet() const;
+    void SetArgs(const css::uno::Sequence<css::beans::PropertyValue>& rArgs);
+    css::uno::Sequence<css::beans::PropertyValue> GetArgs() const;
+     void                Close(bool bInDestruction = false);
+     void                CloseAndRelease();
+     void                ReOpen();
+diff --git a/sc/source/ui/dbgui/imoptdlg.cxx b/sc/source/ui/dbgui/imoptdlg.cxx
+index 26781924baac..7aa8c8acb061 100644
+--- a/sc/source/ui/dbgui/imoptdlg.cxx
+++ b/sc/source/ui/dbgui/imoptdlg.cxx
+@@ -20,6 +20,7 @@
+ #include <imoptdlg.hxx>
+ #include <asciiopt.hxx>
+ #include <comphelper/string.hxx>
+#include <unotools/charclass.hxx>
+ #include <osl/thread.h>
+ #include <global.hxx>
+ 
+@@ -43,6 +44,7 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
+     bSaveNumberAsSuch = true;
+     bSaveFormulas = false;
+     bRemoveSpace = false;
+    nSheetToExport = 0;
+     sal_Int32 nTokenCount = comphelper::string::getTokenCount(rStr, ',');
+     if ( nTokenCount >= 3 )
+     {
+@@ -76,6 +78,16 @@ ScImportOptions::ScImportOptions( const OUString& rStr )
+                 bSaveFormulas = rStr.getToken(0, ',', nIdx) == "true";
+             if ( nTokenCount >= 11 )
+                 bRemoveSpace = rStr.getToken(0, ',', nIdx) == "true";
+            if ( nTokenCount >= 12 )
+            {
+                const OUString aTok(rStr.getToken(0, ',', nIdx));
+                if (aTok == "-1")
+                    nSheetToExport = -1;    // all
+                else if (aTok.isEmpty() || CharClass::isAsciiNumeric(aTok))
+                    nSheetToExport = aTok.toInt32();
+                else
+                    nSheetToExport = -23;   // invalid, force error
+            }
+         }
+     }
+ }
+@@ -99,7 +111,9 @@ OUString ScImportOptions::BuildString() const
+             "," +
+             OUString::boolean( bSaveFormulas ) +  // "save formulas": not in ScAsciiOptions
+             "," +
+-            OUString::boolean( bRemoveSpace );    // same as "Remove space" in ScAsciiOptions
+            OUString::boolean( bRemoveSpace ) +  // same as "Remove space" in ScAsciiOptions
+            "," +
+            OUString::number(nSheetToExport) ;  // Only available for command line --convert-to
+ 
+     return aResult;
+ }
+diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
+index bd7402231333..1c544fb6fa1a 100644
+--- a/sc/source/ui/docshell/docsh.cxx
+++ b/sc/source/ui/docshell/docsh.cxx
+@@ -45,6 +45,7 @@
+ #include <sfx2/objface.hxx>
+ #include <sfx2/viewfrm.hxx>
+ #include <svl/documentlockfile.hxx>
+#include <svl/fstathelper.hxx>
+ #include <svl/sharecontrolfile.hxx>
+ #include <svl/urihelper.hxx>
+ #include <osl/file.hxx>
+@@ -120,6 +121,7 @@
+ #include <comphelper/processfactory.hxx>
+ #include <comphelper/string.hxx>
+ #include <unotools/configmgr.hxx>
+#include <unotools/ucbstreamhelper.hxx>
+ #include <uiitems.hxx>
+ #include <dpobject.hxx>
+ #include <markdata.hxx>
+@@ -1920,7 +1922,7 @@ void escapeTextSep(sal_Int32 nPos, const StrT& rStrDelim, StrT& rStr)
+ 
+ }
+ 
+-void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt )
+void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt, SCTAB nTab )
+ {
+     sal_Unicode cDelim    = rAsciiOpt.nFieldSepCode;
+     sal_Unicode cStrDelim = rAsciiOpt.nTextSepCode;
+@@ -1966,7 +1968,6 @@ void ScDocShell::AsciiSave( SvStream& rStream, const ScImportOptions& rAsciiOpt
+ 
+     SCCOL nStartCol = 0;
+     SCROW nStartRow = 0;
+-    SCTAB nTab = GetSaveTab();
+     SCCOL nEndCol;
+     SCROW nEndRow;
+     m_aDocument.GetCellArea( nTab, nEndCol, nEndRow );
+@@ -2384,35 +2385,129 @@ bool ScDocShell::ConvertTo( SfxMedium &rMed )
+     }
+     else if (aFltName == pFilterAscii)
+     {
+-        SvStream* pStream = rMed.GetOutStream();
+-        if (pStream)
+        OUString sItStr;
+        SfxItemSet*  pSet = rMed.GetItemSet();
+        const SfxPoolItem* pItem;
+        if ( pSet && SfxItemState::SET ==
+             pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
+         {
+-            OUString sItStr;
+-            SfxItemSet*  pSet = rMed.GetItemSet();
+-            const SfxPoolItem* pItem;
+-            if ( pSet && SfxItemState::SET ==
+-                 pSet->GetItemState( SID_FILE_FILTEROPTIONS, true, &pItem ) )
+            sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
+        }
+
+        if ( sItStr.isEmpty() )
+        {
+            //  default for ascii export (from API without options):
+            //  ISO8859-1/MS_1252 encoding, comma, double quotes
+
+            ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
+            sItStr = aDefOptions.BuildString();
+        }
+
+        weld::WaitObject aWait( GetActiveDialogParent() );
+        ScImportOptions aOptions( sItStr );
+
+        if (aOptions.nSheetToExport)
+        {
+            // Only from command line --convert-to
+            bRet = true;
+
+            // Verbose only from command line, not UI (in case we actually
+            // implement that) nor macro filter options.
+            bool bVerbose = false;
+            const css::uno::Sequence<css::beans::PropertyValue> & rArgs = rMed.GetArgs();
+            const auto pProp = std::find_if( rArgs.begin(), rArgs.end(),
+                    [](const css::beans::PropertyValue& rProp) { return rProp.Name == "ConversionRequestOrigin"; });
+            if (pProp != rArgs.end())
+             {
+-                sItStr = static_cast<const SfxStringItem*>(pItem)->GetValue();
+                OUString aOrigin;
+                pProp->Value >>= aOrigin;
+                bVerbose = (aOrigin == "CommandLine");
+             }
+ 
+-            if ( sItStr.isEmpty() )
+            SCTAB nStartTab;
+            SCTAB nCount = m_aDocument.GetTableCount();
+            if (aOptions.nSheetToExport == -1)
+             {
+-                //  default for ascii export (from API without options):
+-                //  ISO8859-1/MS_1252 encoding, comma, double quotes
+-
+-                ScImportOptions aDefOptions( ',', '"', RTL_TEXTENCODING_MS_1252 );
+-                sItStr = aDefOptions.BuildString();
+                // All sheets.
+                nStartTab = 0;
+            }
+            else if (0 < aOptions.nSheetToExport && aOptions.nSheetToExport <= nCount)
+            {
+                // One sheet, 1-based.
+                nCount = aOptions.nSheetToExport;
+                nStartTab = nCount - 1;
+            }
+            else
+            {
+                // Usage error, no export but log.
+                if (bVerbose)
+                {
+                    if (aOptions.nSheetToExport < 0)
+                        std::cout << "Bad sheet number string given." << std::endl;
+                    else
+                        std::cout << "No sheet number " << aOptions.nSheetToExport
+                            << ", number of sheets is " << nCount << std::endl;
+                }
+                nStartTab = 0;
+                nCount = 0;
+                SetError(SCERR_EXPORT_DATA);
+                bRet = false;
+             }
+ 
+-            weld::WaitObject aWait( GetActiveDialogParent() );
+-            ScImportOptions aOptions( sItStr );
+-            AsciiSave( *pStream, aOptions );
+-            bRet = true;
+            INetURLObject aURLObject(rMed.GetURLObject());
+            OUString sExt = aURLObject.CutExtension();
+            OUString sBaseName = aURLObject.GetLastName();
+            aURLObject.CutLastName();
+ 
+-            if (m_aDocument.GetTableCount() > 1)
+-                if (!rMed.GetError())
+-                    rMed.SetError(SCWARN_EXPORT_ASCII);
+            for (SCTAB i = nStartTab; i < nCount; ++i)
+            {
+                OUString sTabName;
+                if (!m_aDocument.GetName(i, sTabName))
+                    sTabName = OUString::number(i);
+                INetURLObject aSheetURLObject(aURLObject);
+                OUString sFileName = sBaseName + "-" + sTabName;
+                if (!sExt.isEmpty())
+                    sFileName = sFileName + "." + sExt;
+                aSheetURLObject.Append(sFileName);
+
+                // log similar to DispatchWatcher::executeDispatchRequests
+                OUString aOutFile = aSheetURLObject.GetMainURL(INetURLObject::DecodeMechanism::NONE);
+                if (bVerbose)
+                {
+                    OUString aDisplayedName;
+                    if (osl::FileBase::E_None != osl::FileBase::getSystemPathFromFileURL(aOutFile, aDisplayedName))
+                        aDisplayedName = aOutFile;
+                    std::cout << "Writing sheet " << OUStringToOString(sTabName, osl_getThreadTextEncoding()) << " -> "
+                                                  << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
+                                                  << std::endl;
+
+                    if (FStatHelper::IsDocument(aOutFile))
+                        std::cout << "Overwriting: " << OUStringToOString(aDisplayedName, osl_getThreadTextEncoding())
+                                                     << std::endl ;
+                }
+
+                std::unique_ptr<SvStream> xStm = ::utl::UcbStreamHelper::CreateStream(aOutFile, StreamMode::TRUNC | StreamMode::WRITE);
+                if (!xStm)
+                {
+                    SetError(ERRCODE_IO_CANTCREATE);
+                    bRet = false;
+                    break;
+                }
+                AsciiSave(*xStm, aOptions, i);
+            }
+        }
+        else
+        {
+            SvStream* pStream = rMed.GetOutStream();
+            if (pStream)
+            {
+                AsciiSave(*pStream, aOptions, GetSaveTab());
+                bRet = true;
+
+                if (m_aDocument.GetTableCount() > 1)
+                    if (!rMed.GetError())
+                        rMed.SetError(SCWARN_EXPORT_ASCII);
+            }
+         }
+     }
+     else if (aFltName == pFilterDBase)
+diff --git a/sc/source/ui/inc/docsh.hxx b/sc/source/ui/inc/docsh.hxx
+index a519f4c87d04..6a075ff6dade 100644
+--- a/sc/source/ui/inc/docsh.hxx
+++ b/sc/source/ui/inc/docsh.hxx
+@@ -230,7 +230,7 @@ public:
+ 
+     ScDrawLayer*    MakeDrawLayer();
+ 
+-    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt );
+    void            AsciiSave( SvStream& rStream, const ScImportOptions& rOpt, SCTAB nTab );
+ 
+     void            Execute( SfxRequest& rReq );
+     void            GetState( SfxItemSet &rSet );
+diff --git a/sc/source/ui/inc/imoptdlg.hxx b/sc/source/ui/inc/imoptdlg.hxx
+index bac941c2a377..382067d67813 100644
+--- a/sc/source/ui/inc/imoptdlg.hxx
+++ b/sc/source/ui/inc/imoptdlg.hxx
+@@ -32,7 +32,8 @@ public:
+         ScImportOptions( sal_Unicode nFieldSep, sal_Unicode nTextSep, rtl_TextEncoding nEnc )
+             : nFieldSepCode(nFieldSep), nTextSepCode(nTextSep),
+             bFixedWidth(false), bSaveAsShown(false), bQuoteAllText(false),
+-            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false)
+            bSaveNumberAsSuch(true), bSaveFormulas(false), bRemoveSpace(false),
+            nSheetToExport(0)
+         { SetTextEncoding( nEnc ); }
+ 
+     ScImportOptions& operator=( const ScImportOptions& rCpy ) = default;
+@@ -51,6 +52,9 @@ public:
+     bool        bSaveNumberAsSuch;
+     bool        bSaveFormulas;
+     bool        bRemoveSpace;
+    // "0" for 'current sheet', "-1" for all sheets (each to a separate file),
+    // or 1-based specific sheet number (to a separate file).
+    sal_Int32   nSheetToExport;
+ };
+ 
+ #endif // INCLUDED_SC_SOURCE_UI_INC_IMOPTDLG_HXX
+diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx
+index 5d00d39bd837..4e4e74a 100644
+--- a/sfx2/source/doc/docfile.cxx
+++ b/sfx2/source/doc/docfile.cxx
+@@ -328,6 +328,8 @@ public:
+ 
+     util::DateTime m_aDateTime;
+ 
+    uno::Sequence<beans::PropertyValue> m_aArgs;
+
+     explicit SfxMedium_Impl();
+     ~SfxMedium_Impl();
+     SfxMedium_Impl(const SfxMedium_Impl&) = delete;
+@@ -3240,6 +3242,7 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
+     SfxAllItemSet *pParams = new SfxAllItemSet( SfxGetpApp()->GetPool() );
+     pImpl->m_pSet.reset( pParams );
+     TransformParameters( SID_OPENDOC, aArgs, *pParams );
+    SetArgs(aArgs);
+ 
+     OUString aFilterProvider, aFilterName;
+     {
+@@ -3301,6 +3304,16 @@ SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
+     Init_Impl();
+ }
+ 
+void SfxMedium::SetArgs(const uno::Sequence<beans::PropertyValue>& rArgs)
+{
+    pImpl->m_aArgs = rArgs;
+    comphelper::SequenceAsHashMap aArgsMap(rArgs);
+    aArgsMap.erase("Stream");
+    aArgsMap.erase("InputStream");
+    pImpl->m_aArgs = aArgsMap.getAsConstPropertyValueList();
+}
+
+uno::Sequence<beans::PropertyValue> SfxMedium::GetArgs() const { return pImpl->m_aArgs; }
+ 
+ SfxMedium::SfxMedium( const uno::Reference < embed::XStorage >& rStor, const OUString& rBaseURL, const std::shared_ptr<SfxItemSet>& p ) :
+     pImpl(new SfxMedium_Impl)
+-- 
+2.31.1
+
--- a/SOURCES/0001-set-Referer-on-loading-IFrames.patch
+++ b/SOURCES/0001-set-Referer-on-loading-IFrames.patch
@ -0,0 +1,93 @@
+From a7bc0ab5215734cb2bd4162cb5cdcc69fef23ef4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 11 Apr 2023 10:13:37 +0100
+Subject: [PATCH 1/3] set Referer on loading IFrames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+so tools, options, security, options,
+"block any links from document not..."
+applies to their contents.
+
+Change-Id: I04839aea6b07a4a76ac147a85045939ccd9c3c79
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150221
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150751
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit acff9ca0579333b45d10ae5f8cd48172f563dddd)
+(cherry picked from commit 04c8176fb40d2eb983aa0bd0a6ce65804d3f6ecd)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152094
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+
+(cherry picked from commit 789155b523b384df020d86228ac200a63a68b154)
+Conflicts:
+	sfx2/source/doc/iframe.cxx
+---
+ sfx2/source/doc/iframe.cxx | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index b5291b239164b..5a0ea96a234da 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -32,12 +32,14 @@
+ #include <com/sun/star/ui/dialogs/XExecutableDialog.hpp>
+ #include <com/sun/star/embed/XEmbeddedObject.hpp>
+ 
+#include <comphelper/propertyvalue.hxx>
+ #include <cppuhelper/implbase.hxx>
+ #include <cppuhelper/supportsservice.hxx>
+ #include <rtl/ref.hxx>
+ #include <svtools/miscopt.hxx>
+ #include <svl/ownlist.hxx>
+ #include <svl/itemprop.hxx>
+#include <sfx2/docfile.hxx>
+ #include <sfx2/frmdescr.hxx>
+ #include <sfx2/objsh.hxx>
+ #include <sfx2/sfxdlg.hxx>
+@@ -166,14 +168,19 @@ sal_Bool SAL_CALL IFrameObject::load(
+         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+         xTrans->parseStrict( aTargetURL );
+ 
+        uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+        SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+
+         if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+         {
+-            uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+-            SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+             if (pDoc && !pDoc->AdjustMacroMode())
+                 return false;
+         }
+ 
+        OUString sReferer;
+        if (pDoc && pDoc->HasName())
+            sReferer = pDoc->GetMedium()->GetName();
+
+         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+@@ -196,12 +203,11 @@ sal_Bool SAL_CALL IFrameObject::load(
+         if ( xFramesSupplier.is() )
+             mxFrame->setCreator( xFramesSupplier );
+ 
+-        uno::Sequence < beans::PropertyValue > aProps(2);
+-        aProps[0].Name = "PluginMode";
+-        aProps[0].Value <<= sal_Int16(2);
+-        aProps[1].Name = "ReadOnly";
+-        aProps[1].Value <<= true;
+-
+        uno::Sequence < beans::PropertyValue > aProps{
+            comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
+            comphelper::makePropertyValue("ReadOnly", true),
+            comphelper::makePropertyValue("Referer", sReferer)
+        };
+         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( aTargetURL, "_self", 0 );
+         if ( xDisp.is() )
+             xDisp->dispatch( aTargetURL, aProps );
+-- 
+2.41.0
+
--- a/SOURCES/0002-CVE-2021-25635.patch
+++ b/SOURCES/0002-CVE-2021-25635.patch
@ -0,0 +1,56 @@
+From a9102a384893fd084011e8451867071452031ece Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 8 Feb 2021 17:05:28 +0000
+Subject: [PATCH 2/6] CVE-2021-25635
+
+default to CertificateValidity::INVALID
+
+so if CertGetCertificateChain fails we don't want validity to be
+css::security::CertificateValidity::VALID which is what the old default
+of 0 equates to
+
+notably
+
+commit 1e0bc66d16aee28ce8bd9582ea32178c63841902
+Date:   Thu Nov 5 16:55:26 2009 +0100
+
+    jl137:  #103420# better logging
+
+turned the nss equivalent of SecurityEnvironment_NssImpl::verifyCertificate
+from 0 to CertificateValidity::INVALID like this change does
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110561
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit edeb164c1d8ab64116afee4e2140403a362a1358)
+
+Change-Id: I5350dbc22d1b9b378da2976d3b0abd728f1f4c27
+---
+ .../source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+index d9b657891b96..4031df289f44 100644
+--- a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+++ b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
+@@ -755,7 +755,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
+     const uno::Reference< css::security::XCertificate >& aCert,
+     const uno::Sequence< uno::Reference< css::security::XCertificate > >& seqCerts)
+ {
+-    sal_Int32 validity = 0;
+    sal_Int32 validity = css::security::CertificateValidity::INVALID;
+     PCCERT_CHAIN_CONTEXT pChainContext = nullptr;
+     PCCERT_CONTEXT pCertContext = nullptr;
+ 
+@@ -899,7 +899,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
+         }
+         else
+         {
+-            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChaine failed.");
+            SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChain failed.");
+         }
+     }
+ 
+-- 
+2.32.0
+
--- a/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
+++ b/SOURCES/0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
@ -0,0 +1,198 @@
+From 61f8673fb44150bd629d88f6626aff8d5b026449 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 21 Mar 2022 20:58:34 +0000
+Subject: [PATCH] make hash encoding match decoding
+
+Seeing as old versions of the hash may be in the users config, add a
+StorageVersion field to the office config Passwords section which
+defaults to 0 to indicate the old hash is in use.
+
+Try the old varient when StorageVersion is 0. When a new encoded master
+password it set write StorageVersion of 1 to indicate a new hash is in
+use and use the new style when StorageVersion is 1.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+(cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)
+
+svl: fix crash if user cancels/closes master password dialog
+
+(regression from d7ba5614d90381d68f880ca7e7c5ef8bbb1b1c43)
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133932
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit bbb8617ece6d946957c2eb96287081029bce530f)
+
+Change-Id: I3174c37a5891bfc849984e0ec5c2c392b9c6e7b1
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133905
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ .../schema/org/openoffice/Office/Common.xcs   |  6 +++
+ .../passwordcontainer/passwordcontainer.cxx   | 47 ++++++++++++++++++-
+ .../passwordcontainer/passwordcontainer.hxx   |  6 +++
+ uui/source/iahndl-authentication.cxx          |  5 +-
+ 4 files changed, 60 insertions(+), 4 deletions(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index b317f616deeb..b033b29b60d7 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -911,6 +911,12 @@
+         </info>
+         <value>false</value>
+       </prop>
+      <prop oor:name="StorageVersion" oor:type="xs:int" oor:nillable="false">
+        <info>
+          <desc>Specifies what version of encoding scheme the password container uses.</desc>
+        </info>
+        <value>0</value>
+      </prop>
+       <prop oor:name="HasMaster" oor:type="xs:boolean" oor:nillable="false">
+         <info>
+           <desc>Specifies if there is a valid master password.</desc>
+diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
+index 02947cd3892c..ff0b40df4016 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.cxx
+++ b/svl/source/passwordcontainer/passwordcontainer.cxx
+@@ -17,6 +17,8 @@
+  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
+  */
+ 
+#include <sal/config.h>
+#include <sal/log.hxx>
+ 
+ #include "passwordcontainer.hxx"
+ 
+@@ -259,6 +261,23 @@ bool StorageItem::useStorage()
+     return aResult;
+ }
+ 
+sal_Int32 StorageItem::getStorageVersion()
+{
+    Sequence<OUString> aNodeNames { "StorageVersion" };
+
+    Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
+
+    if( aPropertyValues.getLength() != aNodeNames.getLength() )
+    {
+        OSL_FAIL( "Problems during reading" );
+        return 0;
+    }
+
+    sal_Int32 nResult = 0;
+    aPropertyValues[0] >>= nResult;
+
+    return nResult;
+}
+ 
+ bool StorageItem::getEncodedMP( OUString& aResult )
+ {
+@@ -291,15 +310,17 @@ bool StorageItem::getEncodedMP( OUString& aResult )
+ 
+ void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
+ {
+-    Sequence< OUString > sendNames(2);
+-    Sequence< uno::Any > sendVals(2);
+    Sequence< OUString > sendNames(3);
+    Sequence< uno::Any > sendVals(3);
+ 
+     sendNames[0] = "HasMaster";
+     sendNames[1] = "Master";
+    sendNames[2] = "StorageVersion";
+ 
+     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
+     sendVals[0] <<= bHasMaster;
+     sendVals[1] <<= aEncoded;
+    sendVals[2] <<= nCurrentStorageVersion;
+ 
+     ConfigItem::SetModified();
+     ConfigItem::PutProperties( sendNames, sendVals );
+@@ -800,6 +821,18 @@ OUString PasswordContainer::RequestPasswordFromUser( PasswordRequestMode aRMode,
+     return aResult;
+ }
+ 
+// Mangle the key to match an old bug
+static OUString ReencodeAsOldHash(const OUString& rPass)
+{
+    OUStringBuffer aBuffer;
+    for (int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ++ind)
+    {
+        unsigned char i = static_cast<char>(rPass.copy(ind * 2, 2).toUInt32(16));
+        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
+        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
+    }
+    return aBuffer.makeStringAndClear();
+}
+ 
+ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInteractionHandler >& aHandler )
+ {
+@@ -838,6 +871,9 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+                     }
+                     else
+                     {
+                        if (m_pStorageFile->getStorageVersion() == 0)
+                            aPass = ReencodeAsOldHash(aPass);
+
+                         std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
+                         if( aRM.empty() || aPass != aRM[0] )
+                         {
+@@ -1042,6 +1078,13 @@ sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::R
+ 
+                 do {
+                     aPass = RequestPasswordFromUser( aRMode, xTmpHandler );
+
+
+                    if (!aPass.isEmpty() && m_pStorageFile->getStorageVersion() == 0)
+                    {
+                        aPass = ReencodeAsOldHash(aPass);
+                    }
+
+                     bResult = ( !aPass.isEmpty() && aPass == m_aMasterPasswd );
+                     aRMode = PasswordRequestMode_PASSWORD_REENTER; // further questions with error notification
+                 } while( !bResult && !aPass.isEmpty() );
+diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
+index 09fb7e03629d..cf5c717d0c9e 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.hxx
+++ b/svl/source/passwordcontainer/passwordcontainer.hxx
+@@ -167,6 +167,10 @@ public:
+ typedef ::std::pair< const OUString, ::std::vector< NamePassRecord > > PairUrlRecord;
+ typedef ::std::map< OUString, ::std::vector< NamePassRecord > > PassMap;
+ 
+// org.openoffice.Office.Common/Passwords/StorageVersion bump if details of
+// how password details are saved changes. Enables migration from previous
+// schemes.
+constexpr sal_Int32 nCurrentStorageVersion = 1;
+ 
+ class PasswordContainer;
+ 
+@@ -195,6 +199,8 @@ public:
+     void remove( const OUString& url, const OUString& rec );
+     void clear();
+ 
+    sal_Int32 getStorageVersion();
+
+     bool getEncodedMP( OUString& aResult );
+     void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
+     void setUseStorage( bool bUse );
+diff --git a/uui/source/iahndl-authentication.cxx b/uui/source/iahndl-authentication.cxx
+index 4835a485dd2a..5764e62cb1c6 100644
+--- a/uui/source/iahndl-authentication.cxx
+++ b/uui/source/iahndl-authentication.cxx
+@@ -436,8 +436,9 @@ executeMasterPasswordDialog(
+     OUStringBuffer aBuffer;
+     for (sal_uInt8 i : aKey)
+     {
+-        aBuffer.append(static_cast< sal_Unicode >('a' + (i >> 4)));
+-        aBuffer.append(static_cast< sal_Unicode >('a' + (i & 15)));
+        // match PasswordContainer::DecodePasswords aMasterPasswd.copy(index * 2, 2).toUInt32(16));
+        aBuffer.append(OUString::number(i >> 4, 16));
+        aBuffer.append(OUString::number(i & 15, 16));
+     }
+     rInfo.SetPassword(aBuffer.makeStringAndClear());
+ }
+-- 
+2.37.1
+
--- a/SOURCES/0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch
+++ b/SOURCES/0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch
@ -0,0 +1,87 @@
+From 99b453dfac5ed44a02c6e1a51b871ee50709a405 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Sat, 4 Nov 2023 19:57:51 +0000
+Subject: [PATCH] warn about exotic protocols as well
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151834
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 1305f70cff8a81a58a5a6d9c96c5bb032005389e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159034
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159881
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159911
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+
+erAck: backported to 6.4.7.2
+
+---
+ sw/source/filter/html/htmlplug.cxx | 2 +-
+ sw/source/filter/xml/xmltexti.cxx  | 2 +-
+ tools/source/fsys/urlobj.cxx       | 3 ++-
+ xmloff/source/draw/ximpshap.cxx    | 2 +-
+ 4 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
+index eb70704..112975f 100644
+--- a/sw/source/filter/html/htmlplug.cxx
+++ b/sw/source/filter/html/htmlplug.cxx
+@@ -1089,7 +1089,7 @@ void SwHTMLParser::InsertFloatingFrame()
+ 
+                 OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
+ 
+-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
+                     NotifyMacroEventRead();
+ 
+                 xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
+diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
+index 72a14b9..e015575 100644
+--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
+@@ -856,7 +856,7 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
+                 OUString sHRef = URIHelper::SmartRel2Abs(
+                             INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
+ 
+-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
+                     GetXMLImport().NotifyMacroEventRead();
+ 
+                 xSet->setPropertyValue("FrameURL",
+diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
+index ab6e885..1ef2b7e 100644
+--- a/tools/source/fsys/urlobj.cxx
+++ b/tools/source/fsys/urlobj.cxx
+@@ -4776,7 +4776,8 @@ bool INetURLObject::IsExoticProtocol() const
+     return m_eScheme == INetProtocol::Slot ||
+            m_eScheme == INetProtocol::Macro ||
+            m_eScheme == INetProtocol::Uno ||
+-           isSchemeEqualTo(u"vnd.sun.star.script");
+           isSchemeEqualTo(u"vnd.sun.star.script") ||
+           isSchemeEqualTo(u"service");
+ }
+ 
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index bd5f30a..b58da79 100644
+--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
+@@ -3269,7 +3269,7 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+ 
+             if( !maHref.isEmpty() )
+             {
+-                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(maHref).IsExoticProtocol())
+                     GetImport().NotifyMacroEventRead();
+ 
+                 xProps->setPropertyValue("FrameURL", Any(maHref) );
+-- 
+2.43.0
+
--- a/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
+++ b/SOURCES/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
@ -0,0 +1,82 @@
+From c0e926365dc7651dcb5eee48f50e6990523662ad Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Fri, 17 Feb 2023 12:03:54 +0100
+Subject: [PATCH 2/3] Stack check safety belt before fishing in muddy waters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Have it hit hard in debug builds.
+
+Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147245
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 166a07062dd4ffedca6106f439a6fcddaeee5eb5)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147391
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit f8efb098f2abbf054a15dcf7daaaacfa575685ae)
+---
+ sc/source/core/inc/interpre.hxx  | 12 ++++++++++++
+ sc/source/core/tool/interpr1.cxx |  4 ++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
+index 3b902524d901..c7d4527dbf57 100644
+--- a/sc/source/core/inc/interpre.hxx
+++ b/sc/source/core/inc/interpre.hxx
+@@ -235,6 +235,7 @@ private:
+     inline bool MustHaveParamCount( short nAct, short nMust );
+     inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
+     inline bool MustHaveParamCountMin( short nAct, short nMin );
+    inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
+     void PushParameterExpected();
+     void PushIllegalParameter();
+     void PushIllegalArgument();
+@@ -1086,6 +1087,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin )
+     return false;
+ }
+ 
+inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin )
+{
+    assert(sp >= nAct);
+    if (sp < nAct)
+    {
+        PushParameterExpected();
+        return false;
+    }
+    return MustHaveParamCountMin( nAct, nMin);
+}
+
+ inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
+ {
+     if (!rtl::math::isFinite( fVal))
+diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
+index e375f1626ec5..4b093cb62d4f 100644
+--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
+@@ -7524,7 +7524,7 @@ void ScInterpreter::ScVLookup()
+ void ScInterpreter::ScSubTotal()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( MustHaveParamCountMin( nParamCount, 2 ) )
+    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
+     {
+         // We must fish the 1st parameter deep from the stack! And push it on top.
+         const FormulaToken* p = pStack[ sp - nParamCount ];
+@@ -7571,7 +7571,7 @@ void ScInterpreter::ScSubTotal()
+ void ScInterpreter::ScAggregate()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( MustHaveParamCountMin( nParamCount, 3 ) )
+    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
+     {
+         // fish the 1st parameter from the stack and push it on top.
+         const FormulaToken* p = pStack[ sp - nParamCount ];
+-- 
+2.41.0
+
--- a/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
+++ b/SOURCES/0002-put-floating-frames-under-managed-links-control.patch
@ -0,0 +1,907 @@
+From 0ea515e760325b3d9f33824e917d0d549f4509e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 13 Apr 2023 11:31:17 +0100
+Subject: [PATCH 2/3] put floating frames under managed links control
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+like we do for sections and ole objects that link to their content
+
+individual commits in trunk are:
+
+extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse
+
+no behaviour change intended
+
+Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825)
+
+use parent window as dialog parent
+
+it makes no odds, but is more convenient for upcoming modification
+
+Change-Id: Ibc5333b137d2da089b3b701ff615c6ddf43063d0
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99)
+
+adjust IFrameObject so it could reuse mxFrame for a reload of content
+
+Change-Id: I7eec3132a23faafd9a2878215a0a117a67bc9bf2
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343
+Tested-by: Caolán McNamara <caolanm@redhat.com>
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206)
+
+query getUserAllowsLinkUpdate for the case of content in a floating frame
+
+similarly to how it works for the more common "normal" embedded objects
+
+Change-Id: I83e38dfa2f84907c2de9680e91f779d34864a9ad
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7)
+
+add a route to get writer Floating Frame links under 'manage links'
+
+Change-Id: If90ff71d6a96342574799312f764badaf97980eb
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be)
+
+allow SvxOle2Shape::resetModifiedState to survive having no SdrObject
+
+Change-Id: Iea059262c124e3f44249e49b4189732310d28156
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c)
+
+create the FloatingFrameShape in a separate step to inserting it
+
+this is derived from the path taken by the AddShape(const OUString&)
+function for this case. No change in behavior is intended.
+
+Change-Id: Id09ae0c65a55a37743ad7c184070fb8dd97d8a7f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024)
+
+add a route to get calc Floating Frame links under 'manage links'
+
+much harder than writer because the organization and ordering
+of properties and object activation etc is different.
+
+This ended up ugly, but functions.
+
+We set FrameURL before AddShape, we have to do it again later because it
+gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
+FrameURL to exist when AddShape triggers SetPersistName which itself
+triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
+know what URL will end up being used. So bodge this by setting FrameURL
+to the temp pre-SdrOle2Obj attached properties and we can smuggle it
+eventually into SdrOle2Obj::SetPersistName at the right point after
+PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
+in order to inform the link manager that this is an IFrame that links to
+a URL
+
+Change-Id: I67fc199fef9e67fa12ca7873f0fe12137aa16d8f
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit b91ea614c0b753ab3d378acd0e2db8262e9dbd72)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151107
+Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+
+(cherry picked from commit 8b35b17ffaab23d72ddec2d9f41be0e30fcaa6c4)
+Conflicts:
+	embeddedobj/source/commonembedding/specialobject.cxx
+	embeddedobj/source/inc/specialobject.hxx
+	include/svx/svdoole2.hxx
+	sfx2/source/doc/iframe.cxx
+	svx/source/svdraw/svdoole2.cxx
+	sw/source/core/ole/ndole.cxx
+	xmloff/source/draw/ximpshap.cxx
+---
+ .../source/commonembedding/embedobj.cxx       |  60 +++++-----
+ .../source/commonembedding/specialobject.cxx  |   9 ++
+ embeddedobj/source/inc/commonembobj.hxx       |   3 +
+ embeddedobj/source/inc/specialobject.hxx      |   6 +
+ include/svx/svdoole2.hxx                      |  17 ++-
+ include/svx/unoshape.hxx                      |   2 +
+ sc/source/ui/docshell/documentlinkmgr.cxx     |   9 +-
+ sfx2/source/doc/iframe.cxx                    |  55 +++++----
+ svx/source/svdraw/svdoole2.cxx                | 104 ++++++++++++++----
+ svx/source/unodraw/shapeimpl.hxx              |   5 +
+ svx/source/unodraw/unoshap4.cxx               |  23 +++-
+ sw/inc/ndole.hxx                              |   4 +-
+ sw/source/core/ole/ndole.cxx                  |  89 ++++++++++++--
+ xmloff/source/draw/ximpshap.cxx               |  29 ++++-
+ xmloff/source/draw/ximpshap.hxx               |   2 +
+ 15 files changed, 335 insertions(+), 90 deletions(-)
+
+diff --git a/embeddedobj/source/commonembedding/embedobj.cxx b/embeddedobj/source/commonembedding/embedobj.cxx
+index e6e5bec2a3160..b402dff22042a 100644
+--- a/embeddedobj/source/commonembedding/embedobj.cxx
+++ b/embeddedobj/source/commonembedding/embedobj.cxx
+@@ -155,6 +155,37 @@ void OCommonEmbeddedObject::StateChangeNotification_Impl( bool bBeforeChange, sa
+     }
+ }
+ 
+void OCommonEmbeddedObject::SetInplaceActiveState()
+{
+    if ( !m_xClientSite.is() )
+        throw embed::WrongStateException( "client site not set, yet", *this );
+
+    uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
+    if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
+        throw embed::WrongStateException(); //TODO: can't activate inplace
+    xInplaceClient->activatingInplace();
+
+    uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
+
+    m_xClientWindow = xClientWindowSupplier->getWindow();
+    m_aOwnRectangle = xInplaceClient->getPlacement();
+    m_aClipRectangle = xInplaceClient->getClipRectangle();
+    awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
+
+    // create own window based on the client window
+    // place and resize the window according to the rectangles
+    uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
+
+    // dispatch provider may not be provided
+    uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
+    bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
+    m_nObjectState = embed::EmbedStates::INPLACE_ACTIVE;
+    if ( !bOk )
+    {
+        SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
+        throw embed::WrongStateException(); //TODO: can't activate inplace
+    }
+}
+ 
+ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
+ {
+@@ -228,34 +259,7 @@ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
+         {
+             if ( nNextState == embed::EmbedStates::INPLACE_ACTIVE )
+             {
+-                if ( !m_xClientSite.is() )
+-                    throw embed::WrongStateException( "client site not set, yet", *this );
+-
+-                uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, uno::UNO_QUERY );
+-                if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
+-                    throw embed::WrongStateException(); //TODO: can't activate inplace
+-                xInplaceClient->activatingInplace();
+-
+-                uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
+-
+-                m_xClientWindow = xClientWindowSupplier->getWindow();
+-                m_aOwnRectangle = xInplaceClient->getPlacement();
+-                m_aClipRectangle = xInplaceClient->getClipRectangle();
+-                awt::Rectangle aRectangleToShow = GetRectangleInterception( m_aOwnRectangle, m_aClipRectangle );
+-
+-                // create own window based on the client window
+-                // place and resize the window according to the rectangles
+-                uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, uno::UNO_QUERY_THROW );
+-
+-                // dispatch provider may not be provided
+-                uno::Reference< frame::XDispatchProvider > xContainerDP = xInplaceClient->getInplaceDispatchProvider();
+-                bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, xContainerDP );
+-                m_nObjectState = nNextState;
+-                if ( !bOk )
+-                {
+-                    SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
+-                    throw embed::WrongStateException(); //TODO: can't activate inplace
+-                }
+                SetInplaceActiveState();
+             }
+             else if ( nNextState == embed::EmbedStates::ACTIVE )
+             {
+diff --git a/embeddedobj/source/commonembedding/specialobject.cxx b/embeddedobj/source/commonembedding/specialobject.cxx
+index 683fe0aab3f25..c17a39accf2c7 100644
+--- a/embeddedobj/source/commonembedding/specialobject.cxx
+++ b/embeddedobj/source/commonembedding/specialobject.cxx
+@@ -47,6 +47,7 @@ uno::Any SAL_CALL OSpecialEmbeddedObject::queryInterface( const uno::Type& rType
+     uno::Any aReturn = ::cppu::queryInterface( rType,
+                                         static_cast< embed::XEmbeddedObject* >( this ),
+                                         static_cast< embed::XInplaceObject* >( this ),
+                                        static_cast< embed::XCommonEmbedPersist* >( static_cast< embed::XEmbedPersist* >( this ) ),
+                                         static_cast< embed::XVisualObject* >( this ),
+                                         static_cast< embed::XClassifiedObject* >( this ),
+                                         static_cast< embed::XComponentSupplier* >( this ),
+@@ -160,4 +161,12 @@ void SAL_CALL OSpecialEmbeddedObject::doVerb( sal_Int32 nVerbID )
+         OCommonEmbeddedObject::doVerb( nVerbID );
+ }
+ 
+void SAL_CALL OSpecialEmbeddedObject::reload(
+                const uno::Sequence< beans::PropertyValue >&,
+                const uno::Sequence< beans::PropertyValue >&)
+{
+    // Allow IFrames to reload their content
+    SetInplaceActiveState();
+}
+
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/embeddedobj/source/inc/commonembobj.hxx b/embeddedobj/source/inc/commonembobj.hxx
+index b2c9acd9ec1e7..73282a00deac4 100644
+--- a/embeddedobj/source/inc/commonembobj.hxx
+++ b/embeddedobj/source/inc/commonembobj.hxx
+@@ -226,6 +226,9 @@ private:
+                     const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
+                     const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs );
+ 
+protected:
+    void SetInplaceActiveState();
+
+ public:
+     OCommonEmbeddedObject(
+         const css::uno::Reference< css::uno::XComponentContext >& rxContext,
+diff --git a/embeddedobj/source/inc/specialobject.hxx b/embeddedobj/source/inc/specialobject.hxx
+index 32ad61a7a5828..ce5c01b35ae7f 100644
+--- a/embeddedobj/source/inc/specialobject.hxx
+++ b/embeddedobj/source/inc/specialobject.hxx
+@@ -48,6 +48,12 @@ public:
+     virtual void SAL_CALL changeState( sal_Int32 nNewState ) override;
+ 
+     virtual void SAL_CALL doVerb( sal_Int32 nVerbID ) override;
+
+// XCommonEmbedPersist
+
+    virtual void SAL_CALL reload(
+                const css::uno::Sequence< css::beans::PropertyValue >& lArguments,
+                const css::uno::Sequence< css::beans::PropertyValue >& lObjArgs ) override;
+ };
+ 
+ #endif
+diff --git a/include/svx/svdoole2.hxx b/include/svx/svdoole2.hxx
+index b192a438bc190..da5f094ab1553 100644
+--- a/include/svx/svdoole2.hxx
+++ b/include/svx/svdoole2.hxx
+@@ -42,6 +42,7 @@ namespace frame { class XModel; }
+ namespace svt { class EmbeddedObjectRef; }
+ 
+ class SdrOle2ObjImpl;
+class SvxOle2Shape;
+ 
+ class SVX_DLLPUBLIC SdrOle2Obj : public SdrRectObj
+ {
+@@ -49,7 +50,7 @@ private:
+     std::unique_ptr<SdrOle2ObjImpl> mpImpl;
+ 
+ private:
+-    SVX_DLLPRIVATE void Connect_Impl();
+    SVX_DLLPRIVATE void Connect_Impl(SvxOle2Shape* pCreator = nullptr);
+     SVX_DLLPRIVATE void Disconnect_Impl();
+     SVX_DLLPRIVATE void AddListeners_Impl();
+     SVX_DLLPRIVATE void RemoveListeners_Impl();
+@@ -105,7 +106,7 @@ public:
+     // OLE object has got a separate PersistName member now;
+     // !!! use ::SetPersistName( ... ) only, if you know what you do !!!
+     const OUString& GetPersistName() const;
+-    void        SetPersistName( const OUString& rPersistName );
+    void        SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator = nullptr );
+ 
+     // One can add an application name to a SdrOle2Obj, which can be queried for
+     // later on (SD needs this for presentation objects).
+@@ -153,7 +154,7 @@ public:
+                                          sal_Int64 nAspect );
+     static bool Unload( const css::uno::Reference< css::embed::XEmbeddedObject >& xObj, sal_Int64 nAspect );
+     bool Unload();
+-    void Connect();
+    void Connect(SvxOle2Shape* pCreator = nullptr);
+     void Disconnect();
+     void ObjectLoaded();
+ 
+@@ -200,6 +201,16 @@ public:
+     void                Connect() { GetRealObject(); }
+ };
+ 
+class SVX_DLLPUBLIC SdrIFrameLink final : public sfx2::SvBaseLink
+{
+    SdrOle2Obj* m_pObject;
+
+public:
+    explicit SdrIFrameLink(SdrOle2Obj* pObject);
+    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
+        const OUString& rMimeType, const css::uno::Any & rValue ) override;
+};
+
+ #endif // INCLUDED_SVX_SVDOOLE2_HXX
+ 
+ /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
+diff --git a/include/svx/unoshape.hxx b/include/svx/unoshape.hxx
+index 0b48d1e433d6e..712552a55281a 100644
+--- a/include/svx/unoshape.hxx
+++ b/include/svx/unoshape.hxx
+@@ -597,6 +597,8 @@ public:
+     bool createObject( const SvGlobalName &aClassName );
+ 
+     void createLink( const OUString& aLinkURL );
+
+    virtual OUString GetAndClearInitialFrameURL();
+ };
+ 
+ 
+diff --git a/sc/source/ui/docshell/documentlinkmgr.cxx b/sc/source/ui/docshell/documentlinkmgr.cxx
+index cb3467c8bb691..8ea3c2cce5fb4 100644
+--- a/sc/source/ui/docshell/documentlinkmgr.cxx
+++ b/sc/source/ui/docshell/documentlinkmgr.cxx
+@@ -142,7 +142,7 @@ bool DocumentLinkManager::hasDdeOrOleOrWebServiceLinks(bool bDde, bool bOle, boo
+         sfx2::SvBaseLink* pBase = rLink.get();
+         if (bDde && dynamic_cast<ScDdeLink*>(pBase))
+             return true;
+-        if (bOle && dynamic_cast<SdrEmbedObjectLink*>(pBase))
+        if (bOle && (dynamic_cast<SdrEmbedObjectLink*>(pBase) || dynamic_cast<SdrIFrameLink*>(pBase)))
+             return true;
+         if (bWebService && dynamic_cast<ScWebServiceLink*>(pBase))
+             return true;
+@@ -173,6 +173,13 @@ bool DocumentLinkManager::updateDdeOrOleOrWebServiceLinks(weld::Window* pWin)
+             continue;
+         }
+ 
+        SdrIFrameLink* pIFrameLink = dynamic_cast<SdrIFrameLink*>(pBase);
+        if (pIFrameLink)
+        {
+            pIFrameLink->Update();
+            continue;
+        }
+
+         ScWebServiceLink* pWebserviceLink = dynamic_cast<ScWebServiceLink*>(pBase);
+         if (pWebserviceLink)
+         {
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index 5a0ea96a234da..fce6cb48ea08f 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -177,31 +177,46 @@ sal_Bool SAL_CALL IFrameObject::load(
+                 return false;
+         }
+ 
+        bool bUpdateAllowed(true);
+        if (pDoc)
+        {
+            // perhaps should only check for file targets, but lets default to making it strong
+            // unless there is a known need to distinguish
+            comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
+            bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
+        }
+        if (!bUpdateAllowed)
+            return false;
+
+         OUString sReferer;
+         if (pDoc && pDoc->HasName())
+             sReferer = pDoc->GetMedium()->GetName();
+ 
+-        DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
+-        VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() );
+-        VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+-        pWin->SetSizePixel( pParent->GetOutputSizePixel() );
+-        pWin->SetBackground();
+-        pWin->Show();
+-
+-        uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
+-        xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
+        uno::Reference<css::awt::XWindow> xParentWindow(xFrame->getContainerWindow());
+ 
+-        // we must destroy the IFrame before the parent is destroyed
+-        xWindow->addEventListener( this );
+-
+-        mxFrame = frame::Frame::create( mxContext );
+-        uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
+-        mxFrame->initialize( xWin );
+-        mxFrame->setName( maFrmDescr.GetName() );
+-
+-        uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
+-        if ( xFramesSupplier.is() )
+-            mxFrame->setCreator( xFramesSupplier );
+        if (!mxFrame.is())
+        {
+            VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow(xParentWindow);
+            VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+            pWin->SetSizePixel( pParent->GetOutputSizePixel() );
+            pWin->SetBackground();
+            pWin->Show();
+
+            uno::Reference < awt::XWindow > xWindow( pWin->GetComponentInterface(), uno::UNO_QUERY );
+            xFrame->setComponent( xWindow, uno::Reference < frame::XController >() );
+
+            // we must destroy the IFrame before the parent is destroyed
+            xWindow->addEventListener( this );
+
+            mxFrame = frame::Frame::create( mxContext );
+            uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), uno::UNO_QUERY );
+            mxFrame->initialize( xWin );
+            mxFrame->setName( maFrmDescr.GetName() );
+
+            uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, uno::UNO_QUERY );
+            if ( xFramesSupplier.is() )
+                mxFrame->setCreator( xFramesSupplier );
+        }
+ 
+         uno::Sequence < beans::PropertyValue > aProps{
+             comphelper::makePropertyValue("PluginMode", sal_Int16(2)),
+diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
+index 16617ecaf94fe..dc5f74811723d 100644
+--- a/svx/source/svdraw/svdoole2.cxx
+++ b/svx/source/svdraw/svdoole2.cxx
+@@ -78,6 +78,7 @@
+ #include <sdr/contact/viewcontactofsdrole2obj.hxx>
+ #include <svx/svdograf.hxx>
+ #include <sdr/properties/oleproperties.hxx>
+#include <svx/unoshape.hxx>
+ #include <svx/xlineit0.hxx>
+ #include <svx/xlnclit.hxx>
+ #include <svx/xbtmpit.hxx>
+@@ -598,6 +599,35 @@ void SdrEmbedObjectLink::Closed()
+     SvBaseLink::Closed();
+ }
+ 
+SdrIFrameLink::SdrIFrameLink(SdrOle2Obj* pObject)
+    : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
+    , m_pObject(pObject)
+{
+    SetSynchron( false );
+}
+
+::sfx2::SvBaseLink::UpdateResult SdrIFrameLink::DataChanged(
+    const OUString&, const uno::Any& )
+{
+    uno::Reference<embed::XEmbeddedObject> xObject = m_pObject->GetObjRef();
+    uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
+    if (xPersObj.is())
+    {
+        // let the IFrameObject reload the link
+        try
+        {
+            xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
+        }
+        catch (const uno::Exception&)
+        {
+        }
+
+        m_pObject->SetChanged();
+    }
+
+    return SUCCESS;
+}
+
+ class SdrOle2ObjImpl
+ {
+ public:
+@@ -615,7 +645,7 @@ public:
+     bool mbLoadingOLEObjectFailed:1; // New local var to avoid repeated loading if load of OLE2 fails
+     bool mbConnected:1;
+ 
+-    SdrEmbedObjectLink* mpObjectLink;
+    sfx2::SvBaseLink* mpObjectLink;
+     OUString maLinkURL;
+ 
+     rtl::Reference<SvxUnoShapeModifyListener> mxModifyListener;
+@@ -815,7 +845,7 @@ bool SdrOle2Obj::IsEmpty() const
+     return !mpImpl->mxObjRef.is();
+ }
+ 
+-void SdrOle2Obj::Connect()
+void SdrOle2Obj::Connect(SvxOle2Shape* pCreator)
+ {
+     if( IsEmptyPresObj() )
+         return;
+@@ -828,7 +858,7 @@ void SdrOle2Obj::Connect()
+         return;
+     }
+ 
+-    Connect_Impl();
+    Connect_Impl(pCreator);
+     AddListeners_Impl();
+ }
+ 
+@@ -927,24 +957,51 @@ void SdrOle2Obj::CheckFileLink_Impl()
+     {
+         try
+         {
+-            uno::Reference< embed::XLinkageSupport > xLinkSupport( mpImpl->mxObjRef.GetObject(), uno::UNO_QUERY );
+            uno::Reference<embed::XEmbeddedObject> xObject = mpImpl->mxObjRef.GetObject();
+            if (!xObject)
+                return;
+ 
+-            if ( xLinkSupport.is() && xLinkSupport->isLink() )
+-            {
+-                OUString aLinkURL = xLinkSupport->getLinkURL();
+            bool bIFrame = false;
+ 
+-                if ( !aLinkURL.isEmpty() )
+            OUString aLinkURL;
+            uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
+            if (xLinkSupport)
+            {
+                if (xLinkSupport->isLink())
+                    aLinkURL = xLinkSupport->getLinkURL();
+            }
+            else
+            {
+                // get IFrame (Floating Frames) listed and updatable from the
+                // manage links dialog
+                SvGlobalName aClassId(xObject->getClassID());
+                if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
+                 {
+-                    // this is a file link so the model link manager should handle it
+-                    sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
+                    uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
+                    if (xSet.is())
+                        xSet->getPropertyValue("FrameURL") >>= aLinkURL;
+                    bIFrame = true;
+                }
+            }
+
+            if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
+            {
+                sfx2::LinkManager* pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
+ 
+-                    if ( pLinkManager )
+                if ( pLinkManager )
+                {
+                    SdrEmbedObjectLink* pEmbedObjectLink = nullptr;
+                    if (!bIFrame)
+                     {
+-                        mpImpl->mpObjectLink = new SdrEmbedObjectLink( this );
+-                        mpImpl->maLinkURL = aLinkURL;
+-                        pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
+-                        mpImpl->mpObjectLink->Connect();
+                        pEmbedObjectLink = new SdrEmbedObjectLink(this);
+                        mpImpl->mpObjectLink = pEmbedObjectLink;
+                     }
+                    else
+                        mpImpl->mpObjectLink = new SdrIFrameLink(this);
+                    mpImpl->maLinkURL = aLinkURL;
+                    pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
+                    if (pEmbedObjectLink)
+                        pEmbedObjectLink->Connect();
+                 }
+             }
+         }
+@@ -955,7 +1012,7 @@ void SdrOle2Obj::CheckFileLink_Impl()
+     }
+ }
+ 
+-void SdrOle2Obj::Connect_Impl()
+void SdrOle2Obj::Connect_Impl(SvxOle2Shape* pCreator)
+ {
+     if(!mpImpl->aPersistName.isEmpty() )
+     {
+@@ -995,6 +1052,17 @@ void SdrOle2Obj::Connect_Impl()
+                 }
+             }
+ 
+            if (pCreator)
+            {
+                OUString sFrameURL(pCreator->GetAndClearInitialFrameURL());
+                if (!sFrameURL.isEmpty() && svt::EmbeddedObjectRef::TryRunningState(mpImpl->mxObjRef.GetObject()))
+                {
+                    uno::Reference<beans::XPropertySet> xSet(mpImpl->mxObjRef->getComponent(), uno::UNO_QUERY);
+                    if (xSet.is())
+                        xSet->setPropertyValue("FrameURL", uno::Any(sFrameURL));
+                }
+            }
+
+             if ( mpImpl->mxObjRef.is() )
+             {
+                 if ( !mpImpl->mxLightClient.is() )
+@@ -1308,14 +1376,14 @@ SdrObjectUniquePtr SdrOle2Obj::getFullDragClone() const
+     return createSdrGrafObjReplacement(false);
+ }
+ 
+-void SdrOle2Obj::SetPersistName( const OUString& rPersistName )
+void SdrOle2Obj::SetPersistName( const OUString& rPersistName, SvxOle2Shape* pCreator )
+ {
+     DBG_ASSERT( mpImpl->aPersistName.isEmpty(), "Persist name changed!");
+ 
+     mpImpl->aPersistName = rPersistName;
+     mpImpl->mbLoadingOLEObjectFailed = false;
+ 
+-    Connect();
+    Connect(pCreator);
+     SetChanged();
+ }
+ 
+diff --git a/svx/source/unodraw/shapeimpl.hxx b/svx/source/unodraw/shapeimpl.hxx
+index a1a4e69630206..4381094d380a3 100644
+--- a/svx/source/unodraw/shapeimpl.hxx
+++ b/svx/source/unodraw/shapeimpl.hxx
+@@ -64,8 +64,11 @@ public:
+ 
+     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
+ };
+
+ class SvxFrameShape : public SvxOle2Shape
+ {
+private:
+    OUString m_sInitialFrameURL;
+ protected:
+     // override these for special property handling in subcasses. Return true if property is handled
+     virtual bool setPropertyValueImpl( const OUString& rName, const SfxItemPropertySimpleEntry* pProperty, const css::uno::Any& rValue ) override;
+@@ -82,6 +85,8 @@ public:
+     virtual void SAL_CALL setPropertyValues( const css::uno::Sequence< OUString >& aPropertyNames, const css::uno::Sequence< css::uno::Any >& aValues ) override;
+ 
+     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
+
+    virtual OUString GetAndClearInitialFrameURL() override;
+ };
+ 
+ 
+diff --git a/svx/source/unodraw/unoshap4.cxx b/svx/source/unodraw/unoshap4.cxx
+index f7629f3388587..6dc18d6cf9e48 100644
+--- a/svx/source/unodraw/unoshap4.cxx
+++ b/svx/source/unodraw/unoshap4.cxx
+@@ -180,7 +180,7 @@ bool SvxOle2Shape::setPropertyValueImpl( const OUString& rName, const SfxItemPro
+ #else
+             pOle = static_cast<SdrOle2Obj*>(GetSdrObject());
+ #endif
+-            pOle->SetPersistName( aPersistName );
+            pOle->SetPersistName( aPersistName, this );
+             return true;
+         }
+         break;
+@@ -501,10 +501,11 @@ void SvxOle2Shape::createLink( const OUString& aLinkURL )
+ 
+ void SvxOle2Shape::resetModifiedState()
+ {
+-    ::comphelper::IEmbeddedHelper* pPersist = GetSdrObject()->getSdrModelFromSdrObject().GetPersist();
+    SdrObject* pObject = GetSdrObject();
+    ::comphelper::IEmbeddedHelper* pPersist = pObject ? pObject->getSdrModelFromSdrObject().GetPersist() : nullptr;
+     if( pPersist && !pPersist->isEnableSetModified() )
+     {
+-        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >( GetSdrObject() );
+        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >(pObject);
+         if( pOle && !pOle->IsEmpty() )
+         {
+             uno::Reference < util::XModifiable > xMod( pOle->GetObjRef(), uno::UNO_QUERY );
+@@ -554,6 +555,11 @@ SvGlobalName SvxOle2Shape::GetClassName_Impl(OUString& rHexCLSID)
+     return aClassName;
+ }
+ 
+OUString SvxOle2Shape::GetAndClearInitialFrameURL()
+{
+    return OUString();
+}
+
+ SvxAppletShape::SvxAppletShape(SdrObject* pObject)
+     : SvxOle2Shape( pObject, getSvxMapProvider().GetMap(SVXMAP_APPLET), getSvxMapProvider().GetPropertySet(SVXMAP_APPLET, SdrObject::GetGlobalDrawObjectItemPool())  )
+ {
+@@ -707,8 +713,19 @@ SvxFrameShape::~SvxFrameShape() throw()
+ {
+ }
+ 
+OUString SvxFrameShape::GetAndClearInitialFrameURL()
+{
+    OUString sRet(m_sInitialFrameURL);
+    m_sInitialFrameURL.clear();
+    return sRet;
+}
+
+ void SvxFrameShape::Create( SdrObject* pNewObj, SvxDrawPage* pNewPage )
+ {
+    uno::Reference<beans::XPropertySet> xSet(static_cast<OWeakObject *>(this), uno::UNO_QUERY);
+    if (xSet)
+        xSet->getPropertyValue("FrameURL") >>= m_sInitialFrameURL;
+
+     SvxShape::Create( pNewObj, pNewPage );
+     const SvGlobalName aIFrameClassId( SO3_IFRAME_CLASSID );
+     createObject(aIFrameClassId);
+diff --git a/sw/inc/ndole.hxx b/sw/inc/ndole.hxx
+index 852fffd84e3d7..a2d9749420970 100644
+--- a/sw/inc/ndole.hxx
+++ b/sw/inc/ndole.hxx
+@@ -28,7 +28,7 @@ class SwGrfFormatColl;
+ class SwDoc;
+ class SwOLENode;
+ class SwOLEListener_Impl;
+-class SwEmbedObjectLink;
+namespace sfx2 { class SvBaseLink; }
+ class DeflateData;
+ 
+ class SW_DLLPUBLIC SwOLEObj
+@@ -90,7 +90,7 @@ class SW_DLLPUBLIC SwOLENode: public SwNoTextNode
+     bool   mbOLESizeInvalid; /**< Should be considered at SwDoc::PrtOLENotify
+                                    (e.g. copied). Is not persistent. */
+ 
+-    SwEmbedObjectLink*  mpObjectLink;
+    sfx2::SvBaseLink*  mpObjectLink;
+     OUString maLinkURL;
+ 
+     SwOLENode(  const SwNodeIndex &rWhere,
+diff --git a/sw/source/core/ole/ndole.cxx b/sw/source/core/ole/ndole.cxx
+index 9000d6ef1b9ee..7501fcdd09d7a 100644
+--- a/sw/source/core/ole/ndole.cxx
+++ b/sw/source/core/ole/ndole.cxx
+@@ -147,6 +147,8 @@ void SAL_CALL SwOLEListener_Impl::disposing( const lang::EventObject& )
+ // TODO/LATER: actually SwEmbedObjectLink should be used here, but because different objects are used to control
+ //             embedded object different link objects with the same functionality had to be implemented
+ 
+namespace {
+
+ class SwEmbedObjectLink : public sfx2::SvBaseLink
+ {
+     SwOLENode*          pOleNode;
+@@ -209,6 +211,44 @@ void SwEmbedObjectLink::Closed()
+     SvBaseLink::Closed();
+ }
+ 
+class SwIFrameLink : public sfx2::SvBaseLink
+{
+    SwOLENode* m_pOleNode;
+
+public:
+    explicit SwIFrameLink(SwOLENode* pNode)
+        : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB)
+        , m_pOleNode(pNode)
+    {
+        SetSynchron( false );
+    }
+
+    ::sfx2::SvBaseLink::UpdateResult DataChanged(
+        const OUString&, const uno::Any& )
+    {
+        uno::Reference<embed::XEmbeddedObject> xObject = m_pOleNode->GetOLEObj().GetOleRef();
+        uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, uno::UNO_QUERY);
+        if (xPersObj.is())
+        {
+            // let the IFrameObject reload the link
+            try
+            {
+                xPersObj->reload(uno::Sequence<beans::PropertyValue>(), uno::Sequence<beans::PropertyValue>());
+            }
+            catch (const uno::Exception&)
+            {
+            }
+
+            m_pOleNode->SetChanged();
+        }
+
+        return SUCCESS;
+    }
+
+};
+
+}
+
+ SwOLENode::SwOLENode( const SwNodeIndex &rWhere,
+                     const svt::EmbeddedObjectRef& xObj,
+                     SwGrfFormatColl *pGrfColl,
+@@ -606,18 +646,49 @@ void SwOLENode::CheckFileLink_Impl()
+     {
+         try
+         {
+-            uno::Reference< embed::XLinkageSupport > xLinkSupport( maOLEObj.m_xOLERef.GetObject(), uno::UNO_QUERY_THROW );
+-            if ( xLinkSupport->isLink() )
+            uno::Reference<embed::XEmbeddedObject> xObject = maOLEObj.m_xOLERef.GetObject();
+            if (!xObject)
+                return;
+
+            bool bIFrame = false;
+
+            OUString aLinkURL;
+            uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, uno::UNO_QUERY);
+            if (xLinkSupport)
+            {
+                if (xLinkSupport->isLink())
+                    aLinkURL = xLinkSupport->getLinkURL();
+            }
+            else
+             {
+-                const OUString aLinkURL = xLinkSupport->getLinkURL();
+-                if ( !aLinkURL.isEmpty() )
+                // get IFrame (Floating Frames) listed and updatable from the
+                // manage links dialog
+                SvGlobalName aClassId(xObject->getClassID());
+                if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
+                {
+                    uno::Reference<beans::XPropertySet> xSet(xObject->getComponent(), uno::UNO_QUERY);
+                    if (xSet.is())
+                        xSet->getPropertyValue("FrameURL") >>= aLinkURL;
+                    bIFrame = true;
+                }
+            }
+
+            if (!aLinkURL.isEmpty()) // this is a file link so the model link manager should handle it
+            {
+                SwEmbedObjectLink* pEmbedObjectLink = nullptr;
+                if (!bIFrame)
+                {
+                    pEmbedObjectLink = new SwEmbedObjectLink(this);
+                    mpObjectLink = pEmbedObjectLink;
+                }
+                else
+                 {
+-                    // this is a file link so the model link manager should handle it
+-                    mpObjectLink = new SwEmbedObjectLink( this );
+-                    maLinkURL = aLinkURL;
+-                    GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
+-                    mpObjectLink->Connect();
+                    mpObjectLink = new SwIFrameLink(this);
+                 }
+                maLinkURL = aLinkURL;
+                GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( *mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
+                if (pEmbedObjectLink)
+                    pEmbedObjectLink->Connect();
+             }
+         }
+         catch( uno::Exception& )
+diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
+index ae35f1e21a87b..bd5f30af7d708 100644
+--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
+@@ -3223,9 +3223,35 @@ SdXMLFloatingFrameShapeContext::~SdXMLFloatingFrameShapeContext()
+ {
+ }
+ 
+uno::Reference<drawing::XShape> SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape() const
+{
+    uno::Reference<lang::XMultiServiceFactory> xServiceFact(GetImport().GetModel(), uno::UNO_QUERY);
+    if (!xServiceFact.is())
+        return nullptr;
+    uno::Reference<drawing::XShape> xShape(
+            xServiceFact->createInstance("com.sun.star.drawing.FrameShape"), uno::UNO_QUERY);
+    return xShape;
+}
+
+ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< css::xml::sax::XAttributeList >& )
+ {
+-    AddShape("com.sun.star.drawing.FrameShape");
+    uno::Reference<drawing::XShape> xShape(SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape());
+
+    uno::Reference< beans::XPropertySet > xProps(xShape, uno::UNO_QUERY);
+    // set FrameURL before AddShape, we have to do it again later because it
+    // gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
+    // FrameURL to exist when AddShape triggers SetPersistName which itself
+    // triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
+    // know what URL will end up being used. So bodge this by setting FrameURL
+    // to the temp pre-SdrOle2Obj attached properties and we can smuggle it
+    // eventually into SdrOle2Obj::SetPersistName at the right point after
+    // PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
+    // in order to inform the link manager that this is an IFrame that links to
+    // a URL
+    if (xProps && !maHref.isEmpty())
+        xProps->setPropertyValue("FrameURL", Any(maHref));
+
+    AddShape(xShape);
+ 
+     if( mxShape.is() )
+     {
+@@ -3234,7 +3260,6 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
+         // set pos, size, shear and rotate
+         SetTransformation();
+ 
+-        uno::Reference< beans::XPropertySet > xProps( mxShape, uno::UNO_QUERY );
+         if( xProps.is() )
+         {
+             if( !maFrameName.isEmpty() )
+diff --git a/xmloff/source/draw/ximpshap.hxx b/xmloff/source/draw/ximpshap.hxx
+index fae45f88f00a9..a00c87e8a0dab 100644
+--- a/xmloff/source/draw/ximpshap.hxx
+++ b/xmloff/source/draw/ximpshap.hxx
+@@ -513,6 +513,8 @@ private:
+     OUString maFrameName;
+     OUString maHref;
+ 
+    css::uno::Reference<css::drawing::XShape> CreateFloatingFrameShape() const;
+
+ public:
+ 
+     SdXMLFloatingFrameShapeContext( SvXMLImport& rImport, sal_uInt16 nPrfx,
+-- 
+2.41.0
+
--- a/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
+++ b/SOURCES/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
@ -0,0 +1,50 @@
+From 7e128f02a7cb513e4e57dbb1970fa316f456aa45 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Mon, 27 Feb 2023 16:10:06 +0100
+Subject: [PATCH 3/3] Always push a result, even if it's only an error
+
+PERCENTILE() and QUARTILE() if an error was passed as argument (or
+an error encountered during obtaining arguments) omitted to push
+an error result, only setting the error.
+
+Fallout from
+
+    commit f336f63da900d76c2bf6e5690f1c8a7bd15a0aa2
+    CommitDate: Thu Mar 3 16:28:59 2016 +0000
+
+        tdf#94635 Add FORECAST.ETS functions to Calc
+
+Change-Id: I23e276fb0ce735cfd6383cc963446499dcf819f4
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147922
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 64914560e279c71ff1233f4bab851e2a292797e6)
+---
+ sc/source/core/tool/interpr3.cxx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/tool/interpr3.cxx b/sc/source/core/tool/interpr3.cxx
+index f219beca9386..d442d4eee224 100644
+--- a/sc/source/core/tool/interpr3.cxx
+++ b/sc/source/core/tool/interpr3.cxx
+@@ -3474,7 +3474,7 @@ void ScInterpreter::ScPercentile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
+        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+@@ -3497,7 +3497,7 @@ void ScInterpreter::ScQuartile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
+        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+-- 
+2.41.0
+
--- a/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
+++ b/SOURCES/0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
@ -0,0 +1,586 @@
+From a3046cfa58bdfa2a1b9ea6287a021230830f056f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Tue, 22 Mar 2022 17:22:22 +0000
+Subject: [PATCH] add Initialization Vectors to password storage
+
+old ones default to the current all zero case and continue to work
+as before
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131974
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 192fa1e3bfc6269f2ebb91716471485a56074aea)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132306
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+(cherry picked from commit ab77587ec300f5c30084471000663c46ddf25dad)
+
+Change-Id: I6fe3b02fafcce1b5e7133e77e76a5118177d77af
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133907
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ .../schema/org/openoffice/Office/Common.xcs   |  10 ++
+ .../passwordcontainer/passwordcontainer.cxx   | 127 ++++++++++++------
+ .../passwordcontainer/passwordcontainer.hxx   |  63 +++++++--
+ 3 files changed, 151 insertions(+), 49 deletions(-)
+
+diff --git a/officecfg/registry/schema/org/openoffice/Office/Common.xcs b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+index b033b29b60d7..e57d26ab3366 100644
+--- a/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Common.xcs
+@@ -27,6 +27,11 @@
+       <info>
+         <desc>Contains a container for passwords.</desc>
+       </info>
+      <prop oor:name="InitializationVector" oor:type="xs:string">
+        <info>
+          <desc>Contains an initialization vector for the password encryption.</desc>
+        </info>
+      </prop>
+       <prop oor:name="Password" oor:type="xs:string" oor:localized="false">
+         <info>
+           <desc>Contains a password encoded with the master password.</desc>
+@@ -923,6 +928,11 @@
+         </info>
+         <value>false</value>
+       </prop>
+      <prop oor:name="MasterInitializationVector" oor:type="xs:string">
+        <info>
+          <desc>Contains an initialization vector for the master password encryption.</desc>
+        </info>
+      </prop>
+       <prop oor:name="Master" oor:type="xs:string" oor:nillable="false">
+         <info>
+           <desc>Contains the master password encrypted by itself.</desc>
+diff --git a/svl/source/passwordcontainer/passwordcontainer.cxx b/svl/source/passwordcontainer/passwordcontainer.cxx
+index ff0b40df4016..380188ef495c 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.cxx
+++ b/svl/source/passwordcontainer/passwordcontainer.cxx
+@@ -184,15 +184,18 @@ PassMap StorageItem::getInfo()
+ 
+     Sequence< OUString > aNodeNames     = ConfigItem::GetNodeNames( "Store" );
+     sal_Int32 aNodeCount = aNodeNames.getLength();
+-    Sequence< OUString > aPropNames( aNodeCount );
+    Sequence< OUString > aPropNames( aNodeCount * 2);
+ 
+     std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.begin(),
+         [](const OUString& rName) -> OUString {
+             return "Store/Passwordstorage['" + rName + "']/Password"; });
+    std::transform(aNodeNames.begin(), aNodeNames.end(), aPropNames.getArray() + aNodeCount,
+        [](const OUString& rName) -> OUString {
+            return "Store/Passwordstorage['" + rName + "']/InitializationVector"; });
+ 
+     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aPropNames );
+ 
+-    if( aPropertyValues.getLength() != aNodeCount )
+    if( aPropertyValues.getLength() != aNodeCount * 2)
+     {
+         OSL_FAIL( "Problems during reading" );
+         return aResult;
+@@ -208,14 +211,16 @@ PassMap StorageItem::getInfo()
+             OUString aName = aUrlUsr[1];
+ 
+             OUString aEPasswd;
+            OUString aIV;
+             aPropertyValues[aNodeInd] >>= aEPasswd;
+            aPropertyValues[aNodeInd + aNodeCount] >>= aIV;
+ 
+             PassMap::iterator aIter = aResult.find( aUrl );
+             if( aIter != aResult.end() )
+-                aIter->second.emplace_back( aName, aEPasswd );
+                aIter->second.emplace_back( aName, aEPasswd, aIV );
+             else
+             {
+-                NamePassRecord aNewRecord( aName, aEPasswd );
+                NamePassRecord aNewRecord( aName, aEPasswd, aIV );
+                 std::vector< NamePassRecord > listToAdd( 1, aNewRecord );
+ 
+                 aResult.insert( PairUrlRecord( aUrl, listToAdd ) );
+@@ -279,17 +284,19 @@ sal_Int32 StorageItem::getStorageVersion()
+     return nResult;
+ }
+ 
+-bool StorageItem::getEncodedMP( OUString& aResult )
+bool StorageItem::getEncodedMP( OUString& aResult, OUString& aResultIV )
+ {
+     if( hasEncoded )
+     {
+         aResult = mEncoded;
+        aResultIV = mEncodedIV;
+         return true;
+     }
+ 
+-    Sequence< OUString > aNodeNames( 2 );
+    Sequence< OUString > aNodeNames( 3 );
+     aNodeNames[0] = "HasMaster";
+     aNodeNames[1] = "Master";
+    aNodeNames[2] = "MasterInitializationVector";
+ 
+     Sequence< Any > aPropertyValues = ConfigItem::GetProperties( aNodeNames );
+ 
+@@ -301,32 +308,37 @@ bool StorageItem::getEncodedMP( OUString& aResult )
+ 
+     aPropertyValues[0] >>= hasEncoded;
+     aPropertyValues[1] >>= mEncoded;
+    aPropertyValues[2] >>= mEncodedIV;
+ 
+     aResult = mEncoded;
+    aResultIV = mEncodedIV;
+ 
+     return hasEncoded;
+ }
+ 
+ 
+-void StorageItem::setEncodedMP( const OUString& aEncoded, bool bAcceptEmpty )
+void StorageItem::setEncodedMP( const OUString& aEncoded, const OUString& aEncodedIV, bool bAcceptEmpty )
+ {
+-    Sequence< OUString > sendNames(3);
+-    Sequence< uno::Any > sendVals(3);
+    Sequence< OUString > sendNames(4);
+    Sequence< uno::Any > sendVals(4);
+ 
+     sendNames[0] = "HasMaster";
+     sendNames[1] = "Master";
+-    sendNames[2] = "StorageVersion";
+    sendNames[2] = "MasterInitializationVector";
+    sendNames[3] = "StorageVersion";
+ 
+     bool bHasMaster = ( !aEncoded.isEmpty() || bAcceptEmpty );
+     sendVals[0] <<= bHasMaster;
+     sendVals[1] <<= aEncoded;
+-    sendVals[2] <<= nCurrentStorageVersion;
+    sendVals[2] <<= aEncodedIV;
+    sendVals[3] <<= nCurrentStorageVersion;
+ 
+     ConfigItem::SetModified();
+     ConfigItem::PutProperties( sendNames, sendVals );
+ 
+     hasEncoded = bHasMaster;
+     mEncoded = aEncoded;
+    mEncodedIV = aEncodedIV;
+ }
+ 
+ 
+@@ -362,11 +374,13 @@ void StorageItem::update( const OUString& aURL, const NamePassRecord& aRecord )
+     forIndex.push_back( aURL );
+     forIndex.push_back( aRecord.GetUserName() );
+ 
+-    Sequence< beans::PropertyValue > sendSeq(1);
+    Sequence< beans::PropertyValue > sendSeq(2);
+ 
+-    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
+    sendSeq[0].Name  = "Store/Passwordstorage['" + createIndex( { aURL, aRecord.GetUserName() } ) + "']/InitializationVector";
+    sendSeq[0].Value <<= aRecord.GetPersistentIV();
+ 
+-    sendSeq[0].Value <<= aRecord.GetPersPasswords();
+    sendSeq[1].Name  = "Store/Passwordstorage['" + createIndex( forIndex ) + "']/Password";
+    sendSeq[1].Value <<= aRecord.GetPersPasswords();
+ 
+     ConfigItem::SetModified();
+     ConfigItem::SetSetProperties( "Store", sendSeq );
+@@ -427,7 +441,7 @@ void SAL_CALL PasswordContainer::disposing( const EventObject& )
+     }
+ }
+ 
+-std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
+std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPasswd, css::task::PasswordRequestMode mode )
+ {
+     if( !aMasterPasswd.isEmpty() )
+     {
+@@ -442,9 +456,16 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
+             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
+ 
+            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
+            if (!aIV.isEmpty())
+            {
+                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
+            }
+
+             rtlCipherError result = rtl_cipher_init (
+                     aDecoder, rtl_Cipher_DirectionDecode,
+-                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
+                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
+ 
+             if( result == rtl_Cipher_E_None )
+             {
+@@ -477,7 +498,7 @@ std::vector< OUString > PasswordContainer::DecodePasswords( const OUString& aLin
+         "Can't decode!", css::uno::Reference<css::uno::XInterface>(), mode);
+ }
+ 
+-OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPasswd )
+OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPasswd)
+ {
+     if( !aMasterPasswd.isEmpty() )
+     {
+@@ -494,9 +515,16 @@ OUString PasswordContainer::EncodePasswords(const std::vector< OUString >& lines
+             for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                 code[ ind ] = static_cast<char>(aMasterPasswd.copy( ind*2, 2 ).toUInt32(16));
+ 
+            unsigned char iv[RTL_DIGEST_LENGTH_MD5] = {0};
+            if (!aIV.isEmpty())
+            {
+                for( int ind = 0; ind < RTL_DIGEST_LENGTH_MD5; ind++ )
+                    iv[ ind ] = static_cast<char>(aIV.copy( ind*2, 2 ).toUInt32(16));
+            }
+
+             rtlCipherError result = rtl_cipher_init (
+                     aEncoder, rtl_Cipher_DirectionEncode,
+-                    code, RTL_DIGEST_LENGTH_MD5, nullptr, 0 );
+                    code, RTL_DIGEST_LENGTH_MD5, iv, RTL_DIGEST_LENGTH_MD5 );
+ 
+             if( result == rtl_Cipher_E_None )
+             {
+@@ -564,7 +592,7 @@ void PasswordContainer::UpdateVector( const OUString& aURL, std::vector< NamePas
+ 
+             if( aRecord.HasPasswords( PERSISTENT_RECORD ) )
+             {
+-                aNPIter.SetPersPasswords( aRecord.GetPersPasswords() );
+                aNPIter.SetPersPasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV() );
+ 
+                 if( writeFile )
+                 {
+@@ -597,7 +625,8 @@ UserRecord PasswordContainer::CopyToUserRecord( const NamePassRecord& aRecord, b
+     {
+         try
+         {
+-            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
+            ::std::vector< OUString > aDecodedPasswords = DecodePasswords( aRecord.GetPersPasswords(), aRecord.GetPersistentIV(),
+                                                                           GetMasterPassword( aHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER );
+             aPasswords.insert( aPasswords.end(), aDecodedPasswords.begin(), aDecodedPasswords.end() );
+         }
+         catch( NoMasterException& )
+@@ -642,6 +671,19 @@ void SAL_CALL PasswordContainer::addPersistent( const OUString& Url, const OUStr
+     PrivateAdd( Url, UserName, Passwords, PERSISTENT_RECORD, aHandler );
+ }
+ 
+OUString PasswordContainer::createIV()
+{
+    rtlRandomPool randomPool = mRandomPool.get();
+    unsigned char iv[RTL_DIGEST_LENGTH_MD5];
+    rtl_random_getBytes(randomPool, iv, RTL_DIGEST_LENGTH_MD5);
+    OUStringBuffer aBuffer;
+    for (sal_uInt8 i : iv)
+    {
+        aBuffer.append(OUString::number(i >> 4, 16));
+        aBuffer.append(OUString::number(i & 15, 16));
+    }
+    return aBuffer.makeStringAndClear();
+}
+ 
+ void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserName, const Sequence< OUString >& Passwords, char Mode, const Reference< XInteractionHandler >& aHandler )
+ {
+@@ -649,7 +691,11 @@ void PasswordContainer::PrivateAdd( const OUString& Url, const OUString& UserNam
+     ::std::vector< OUString > aStorePass = comphelper::sequenceToContainer< std::vector<OUString> >( Passwords );
+ 
+     if( Mode == PERSISTENT_RECORD )
+-        aRecord.SetPersPasswords( EncodePasswords( aStorePass, GetMasterPassword( aHandler ) ) );
+    {
+        OUString sIV = createIV();
+        OUString sEncodedPasswords = EncodePasswords( aStorePass, sIV, GetMasterPassword( aHandler ) );
+        aRecord.SetPersPasswords( sEncodedPasswords, sIV );
+    }
+     else if( Mode == MEMORY_RECORD )
+         aRecord.SetMemPasswords( aStorePass );
+     else
+@@ -842,10 +888,10 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+ 
+     if( m_aMasterPasswd.isEmpty() && aHandler.is() )
+     {
+-        OUString aEncodedMP;
+        OUString aEncodedMP, aEncodedMPIV;
+         bool bDefaultPassword = false;
+ 
+-        if( !m_pStorageFile->getEncodedMP( aEncodedMP ) )
+        if( !m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+             aRMode = PasswordRequestMode_PASSWORD_CREATE;
+         else if ( aEncodedMP.isEmpty() )
+         {
+@@ -867,14 +913,15 @@ OUString const & PasswordContainer::GetMasterPassword( const Reference< XInterac
+                         m_aMasterPasswd = aPass;
+                         std::vector< OUString > aMaster( 1, m_aMasterPasswd );
+ 
+-                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
+                        OUString sIV = createIV();
+                        m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, sIV, m_aMasterPasswd ), sIV );
+                     }
+                     else
+                     {
+                         if (m_pStorageFile->getStorageVersion() == 0)
+                             aPass = ReencodeAsOldHash(aPass);
+ 
+-                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aPass, aRMode ) );
+                        std::vector< OUString > aRM( DecodePasswords( aEncodedMP, aEncodedMPIV, aPass, aRMode ) );
+                         if( aRM.empty() || aPass != aRM[0] )
+                         {
+                             bAskAgain = true;
+@@ -1031,7 +1078,8 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
+             {
+                 sal_Int32 oldLen = aUsers.getLength();
+                 aUsers.realloc( oldLen + 1 );
+-                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
+                aUsers[ oldLen ] = UserRecord( aNP.GetUserName(), comphelper::containerToSequence( DecodePasswords( aNP.GetPersPasswords(), aNP.GetPersistentIV(),
+                                                                                                                    GetMasterPassword( xHandler ), css::task::PasswordRequestMode_PASSWORD_ENTER ) ) );
+             }
+ 
+         if( aUsers.hasElements() )
+@@ -1048,12 +1096,12 @@ Sequence< UrlRecord > SAL_CALL PasswordContainer::getAllPersistent( const Refere
+ sal_Bool SAL_CALL PasswordContainer::authorizateWithMasterPassword( const uno::Reference< task::XInteractionHandler >& xHandler )
+ {
+     bool bResult = false;
+-    OUString aEncodedMP;
+    OUString aEncodedMP, aEncodedMPIV;
+     uno::Reference< task::XInteractionHandler > xTmpHandler = xHandler;
+     ::osl::MutexGuard aGuard( mMutex );
+ 
+     // the method should fail if there is no master password
+-    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) )
+    if( m_pStorageFile && m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+     {
+         if ( aEncodedMP.isEmpty() )
+         {
+@@ -1122,8 +1170,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
+ 
+         bool bCanChangePassword = true;
+         // if there is already a stored master password it should be entered by the user before the change happen
+-        OUString aEncodedMP;
+-        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP ) )
+        OUString aEncodedMP, aEncodedMPIV;
+        if( !m_aMasterPasswd.isEmpty() || m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) )
+             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
+ 
+         if ( bCanChangePassword )
+@@ -1142,7 +1190,8 @@ sal_Bool SAL_CALL PasswordContainer::changeMasterPassword( const uno::Reference<
+                 // store the new master password
+                 m_aMasterPasswd = aPass;
+                 std::vector< OUString > aMaster( 1, m_aMasterPasswd );
+-                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, m_aMasterPasswd ) );
+                OUString aIV = createIV();
+                m_pStorageFile->setEncodedMP( EncodePasswords( aMaster, aIV, m_aMasterPasswd ), aIV );
+ 
+                 // store all the entries with the new password
+                 for ( const auto& rURL : aPersistent )
+@@ -1167,7 +1216,7 @@ void SAL_CALL PasswordContainer::removeMasterPassword()
+     if ( m_pStorageFile )
+     {
+         m_aMasterPasswd.clear();
+-        m_pStorageFile->setEncodedMP( OUString() ); // let the master password be removed from configuration
+        m_pStorageFile->setEncodedMP( OUString(), OUString() ); // let the master password be removed from configuration
+     }
+ }
+ 
+@@ -1178,8 +1227,8 @@ sal_Bool SAL_CALL PasswordContainer::hasMasterPassword(  )
+     if ( !m_pStorageFile )
+         throw uno::RuntimeException();
+ 
+-    OUString aEncodedMP;
+-    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) );
+    OUString aEncodedMP, aEncodedMPIV;
+    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) );
+ }
+ 
+ sal_Bool SAL_CALL PasswordContainer::allowPersistentStoring( sal_Bool bAllow )
+@@ -1226,8 +1275,8 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
+ 
+         bool bCanChangePassword = true;
+         // if there is already a stored nondefault master password it should be entered by the user before the change happen
+-        OUString aEncodedMP;
+-        if( m_pStorageFile->getEncodedMP( aEncodedMP ) && !aEncodedMP.isEmpty() )
+        OUString aEncodedMP, aEncodedMPIV;
+        if( m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && !aEncodedMP.isEmpty() )
+             bCanChangePassword = authorizateWithMasterPassword( xTmpHandler );
+ 
+         if ( bCanChangePassword )
+@@ -1244,7 +1293,7 @@ sal_Bool SAL_CALL PasswordContainer::useDefaultMasterPassword( const uno::Refere
+ 
+                 // store the empty string to flag the default master password
+                 m_aMasterPasswd = aPass;
+-                m_pStorageFile->setEncodedMP( OUString(), true );
+                m_pStorageFile->setEncodedMP( OUString(), OUString(), true );
+ 
+                 // store all the entries with the new password
+                 for ( const auto& rURL : aPersistent )
+@@ -1268,8 +1317,8 @@ sal_Bool SAL_CALL PasswordContainer::isDefaultMasterPasswordUsed()
+     if ( !m_pStorageFile )
+         throw uno::RuntimeException();
+ 
+-    OUString aEncodedMP;
+-    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP ) && aEncodedMP.isEmpty() );
+    OUString aEncodedMP, aEncodedMPIV;
+    return ( m_pStorageFile->useStorage() && m_pStorageFile->getEncodedMP( aEncodedMP, aEncodedMPIV ) && aEncodedMP.isEmpty() );
+ }
+ 
+ 
+diff --git a/svl/source/passwordcontainer/passwordcontainer.hxx b/svl/source/passwordcontainer/passwordcontainer.hxx
+index cf5c717d0c9e..4e3a6629139e 100644
+--- a/svl/source/passwordcontainer/passwordcontainer.hxx
+++ b/svl/source/passwordcontainer/passwordcontainer.hxx
+@@ -33,6 +33,7 @@
+ #include <unotools/configitem.hxx>
+ #include <ucbhelper/interactionrequest.hxx>
+ 
+#include <rtl/random.h>
+ #include <rtl/ref.hxx>
+ #include <osl/mutex.hxx>
+ 
+@@ -51,11 +52,12 @@ class NamePassRecord
+     ::std::vector< OUString >                      m_aMemPass;
+ 
+     // persistent passwords are encrypted in one string
+-    bool                                                  m_bHasPersPass;
+    bool                                           m_bHasPersPass;
+     OUString                                       m_aPersPass;
+    OUString                                       m_aPersistentIV;
+ 
+     void InitArrays( bool bHasMemoryList, const ::std::vector< OUString >& aMemoryList,
+-                     bool bHasPersistentList, const OUString& aPersistentList )
+                     bool bHasPersistentList, const OUString& aPersistentList, const OUString& aPersistentIV )
+     {
+         m_bHasMemPass = bHasMemoryList;
+         if ( bHasMemoryList )
+@@ -63,7 +65,10 @@ class NamePassRecord
+ 
+         m_bHasPersPass = bHasPersistentList;
+         if ( bHasPersistentList )
+        {
+             m_aPersPass = aPersistentList;
+            m_aPersistentIV = aPersistentIV;
+        }
+     }
+ 
+ public:
+@@ -75,11 +80,12 @@ public:
+     {
+     }
+ 
+-    NamePassRecord( const OUString& aName, const OUString& aPersistentList )
+    NamePassRecord( const OUString& aName, const OUString& aPersistentList, const OUString& aPersistentIV )
+         : m_aName( aName )
+         , m_bHasMemPass( false )
+         , m_bHasPersPass( true )
+         , m_aPersPass( aPersistentList )
+        , m_aPersistentIV( aPersistentIV )
+     {
+     }
+ 
+@@ -88,7 +94,8 @@ public:
+         , m_bHasMemPass( false )
+         , m_bHasPersPass( false )
+     {
+-        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
+        InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
+                    aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
+     }
+ 
+     NamePassRecord& operator=( const NamePassRecord& aRecord )
+@@ -99,7 +106,9 @@ public:
+ 
+             m_aMemPass.clear();
+             m_aPersPass.clear();
+-            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass, aRecord.m_bHasPersPass, aRecord.m_aPersPass );
+            m_aPersistentIV.clear();
+            InitArrays( aRecord.m_bHasMemPass, aRecord.m_aMemPass,
+                        aRecord.m_bHasPersPass, aRecord.m_aPersPass, aRecord.m_aPersistentIV );
+         }
+         return *this;
+     }
+@@ -135,15 +144,24 @@ public:
+         return OUString();
+     }
+ 
+    OUString GetPersistentIV() const
+    {
+        if ( m_bHasPersPass )
+            return m_aPersistentIV;
+
+        return OUString();
+    }
+
+     void SetMemPasswords( const ::std::vector< OUString >& aMemList )
+     {
+         m_aMemPass = aMemList;
+         m_bHasMemPass = true;
+     }
+ 
+-    void SetPersPasswords( const OUString& aPersList )
+    void SetPersPasswords( const OUString& aPersList, const OUString& aPersIV )
+     {
+         m_aPersPass = aPersList;
+        m_aPersistentIV = aPersIV;
+         m_bHasPersPass = true;
+     }
+ 
+@@ -158,6 +176,7 @@ public:
+         {
+             m_bHasPersPass = false;
+             m_aPersPass.clear();
+            m_aPersistentIV.clear();
+         }
+     }
+ 
+@@ -181,6 +200,7 @@ private:
+     PasswordContainer*     mainCont;
+     bool                   hasEncoded;
+     OUString        mEncoded;
+    OUString        mEncodedIV;
+ 
+     virtual void            ImplCommit() override;
+ 
+@@ -201,8 +221,8 @@ public:
+ 
+     sal_Int32 getStorageVersion();
+ 
+-    bool getEncodedMP( OUString& aResult );
+-    void setEncodedMP( const OUString& aResult, bool bAcceptEnmpty = false );
+    bool getEncodedMP( OUString& aResult, OUString& aResultIV );
+    void setEncodedMP( const OUString& aResult, const OUString& aResultIV, bool bAcceptEmpty = false );
+     void setUseStorage( bool bUse );
+     bool useStorage();
+ 
+@@ -223,6 +243,29 @@ private:
+     css::uno::Reference< css::lang::XComponent > mComponent;
+     SysCredentialsConfig mUrlContainer;
+ 
+    class RandomPool
+    {
+    private:
+        rtlRandomPool m_aRandomPool;
+    public:
+        RandomPool() : m_aRandomPool(rtl_random_createPool())
+        {
+        }
+        rtlRandomPool get()
+        {
+            return m_aRandomPool;
+        }
+        ~RandomPool()
+        {
+            // Clean up random pool memory
+            rtl_random_destroyPool(m_aRandomPool);
+        }
+    };
+
+    RandomPool mRandomPool;
+
+    OUString createIV();
+
+     /// @throws css::uno::RuntimeException
+     css::uno::Sequence< css::task::UserRecord > CopyToUserRecordSequence(
+                                         const ::std::vector< NamePassRecord >& original,
+@@ -273,10 +316,10 @@ css::task::UrlRecord find(
+                               const css::uno::Reference< css::task::XInteractionHandler >& Handler );
+ 
+     /// @throws css::uno::RuntimeException
+-    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
+    static ::std::vector< OUString > DecodePasswords( const OUString& aLine, const OUString& aIV, const OUString& aMasterPassword, css::task::PasswordRequestMode mode );
+ 
+     /// @throws css::uno::RuntimeException
+-    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aMasterPassword );
+    static OUString EncodePasswords(const std::vector< OUString >& lines, const OUString& aIV, const OUString& aMasterPassword );
+ 
+ public:
+     PasswordContainer( const css::uno::Reference< css::lang::XMultiServiceFactory >& );
+-- 
+2.37.1
+
--- a/SOURCES/0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot.patch
+++ b/SOURCES/0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot.patch
@ -0,0 +1,225 @@
+From ae89e7b8ae1e781c1a9d8ca2c5d4aeca656932f8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Fri, 3 Nov 2023 17:26:25 +0000
+Subject: [PATCH] default to ignoring libreoffice special-purpose protocols in
+ calc hyperlink
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
+Tested-by: Jenkins
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159045
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159882
+Tested-by: Miklos Vajna <vmiklos@collabora.com>
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159912
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+
+erAck: backported to 6.4.7.2
+
+---
+ dbaccess/source/core/dataaccess/ModelImpl.cxx |  3 +-
+ include/sfx2/docmacromode.hxx                 |  5 ++-
+ include/sfx2/objsh.hxx                        |  3 ++
+ sc/source/core/data/global.cxx                | 33 ++++++++++++++++++-
+ sfx2/source/doc/docmacromode.cxx              |  8 +++--
+ sfx2/source/doc/objmisc.cxx                   |  8 ++++-
+ sfx2/source/doc/objxtor.cxx                   |  1 +
+ sfx2/source/inc/objshimp.hxx                  |  3 +-
+ 8 files changed, 57 insertions(+), 7 deletions(-)
+
+diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx b/dbaccess/source/core/dataaccess/ModelImpl.cxx
+index 1f11f36..ce4dbae 100644
+--- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
+++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
+@@ -1140,7 +1140,8 @@ bool ODatabaseModelImpl::checkMacrosOnLoading()
+ {
+     Reference< XInteractionHandler > xInteraction;
+     xInteraction = m_aMediaDescriptor.getOrDefault( "InteractionHandler", xInteraction );
+-    return m_aMacroMode.checkMacrosOnLoading( xInteraction );
+    const bool bHasMacros = m_aMacroMode.hasMacros();
+    return m_aMacroMode.checkMacrosOnLoading(xInteraction, bHasMacros);
+ }
+ 
+ void ODatabaseModelImpl::resetMacroExecutionMode()
+diff --git a/include/sfx2/docmacromode.hxx b/include/sfx2/docmacromode.hxx
+index a15bbbe..98b7d3a 100644
+--- a/include/sfx2/docmacromode.hxx
+++ b/include/sfx2/docmacromode.hxx
+@@ -260,6 +260,8 @@ namespace sfx2
+         */
+         static bool storageHasMacros( const css::uno::Reference< css::embed::XStorage >& _rxStorage );
+ 
+        bool hasMacros() const;
+
+         static bool containerHasBasicMacros( const css::uno::Reference< css::script::XLibraryContainer >& xContainter );
+         /** checks the macro execution mode while loading the document.
+ 
+@@ -286,7 +288,8 @@ namespace sfx2
+         */
+         bool
+                 checkMacrosOnLoading(
+-                    const css::uno::Reference< css::task::XInteractionHandler >& _rxInteraction
+                    const css::uno::Reference< css::task::XInteractionHandler >& _rxInteraction,
+                    bool bHasMacros
+                 );
+ 
+     private:
+diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
+index 2a56ebe..43df460 100644
+--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
+@@ -418,6 +418,9 @@ public:
+     void                        SetMacroCallsSeenWhileLoading();
+     bool                        GetMacroCallsSeenWhileLoading() const;
+ 
+    // true if the document had macros (or similar) on load to trigger warning user
+    bool                        GetHadCheckedMacrosOnLoad() const;
+
+     const css::uno::Sequence< css::beans::PropertyValue >& GetModifyPasswordInfo() const;
+     bool                        SetModifyPasswordInfo( const css::uno::Sequence< css::beans::PropertyValue >& aInfo );
+ 
+diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
+index 050fd82..92d50c4 100644
+--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
+@@ -26,7 +26,9 @@
+ #include <sfx2/docfile.hxx>
+ #include <sfx2/dispatch.hxx>
+ #include <sfx2/objsh.hxx>
+#include <sfx2/sfxresid.hxx>
+ #include <sfx2/sfxsids.hrc>
+#include <sfx2/strings.hrc>
+ #include <sfx2/viewfrm.hxx>
+ #include <sfx2/viewsh.hxx>
+ #include <svl/intitem.hxx>
+@@ -789,7 +791,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
+ 
+     OUString aUrlName( rURL );
+     SfxViewFrame* pFrame = nullptr;
+-    const SfxObjectShell* pObjShell = nullptr;
+    SfxObjectShell* pObjShell = nullptr;
+     OUString aReferName;
+     if ( pScActiveViewShell )
+     {
+@@ -823,6 +825,35 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
+             aUrlName = aNewUrlName;
+     }
+ 
+    if (INetURLObject(aUrlName).IsExoticProtocol())
+    {
+        // Default to ignoring exotic protocols
+        bool bAllow = false;
+        if (pObjShell)
+        {
+            // If the document had macros when loaded then follow the allowed macro-mode
+            if (pObjShell->GetHadCheckedMacrosOnLoad())
+                bAllow = pObjShell->AdjustMacroMode();
+            else // otherwise ask the user, defaulting to cancel
+            {
+                assert(pFrame && "if we have pObjShell we have pFrame");
+                //Reuse URITools::onOpenURI warning string
+                std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pFrame->GetFrameWeld(),
+                                                               VclMessageType::Warning, VclButtonsType::YesNo,
+                                                               SfxResId(STR_DANGEROUS_TO_OPEN)));
+                xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+                    INetURLObject::decode(aUrlName, INetURLObject::DecodeMechanism::Unambiguous)));
+                xQueryBox->set_default_response(RET_NO);
+                bAllow = xQueryBox->run() == RET_YES;
+            }
+        }
+        if (!bAllow)
+        {
+            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
+            return;
+        }
+    }
+
+     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
+     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
+     if ( nScClickMouseModifier & KEY_SHIFT )     // control-click -> into new window
+diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
+index 492bd0a..7f1fb2b 100644
+--- a/sfx2/source/doc/docmacromode.cxx
+++ b/sfx2/source/doc/docmacromode.cxx
+@@ -391,8 +391,12 @@ namespace sfx2
+         return bHasMacros;
+     }
+ 
+    bool DocumentMacroMode::hasMacros() const
+    {
+        return m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading();
+    }
+ 
+-    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction )
+    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction, bool bHasMacros )
+     {
+         bool bAllow = false;
+         if ( SvtSecurityOptions().IsMacroDisabled() )
+@@ -402,7 +406,7 @@ namespace sfx2
+         }
+         else
+         {
+-            if (m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
+            if (bHasMacros)
+             {
+                 bAllow = adjustMacroMode( rxInteraction );
+             }
+diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
+index 6819404..fac75dd 100644
+--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
+@@ -953,9 +953,15 @@ void SfxObjectShell::CheckSecurityOnLoading_Impl()
+     CheckEncryption_Impl( xInteraction );
+ 
+     // check macro security
+-    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction );
+    const bool bHasMacros = pImpl->aMacroMode.hasMacros();
+    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasMacros );
+    pImpl->m_bHadCheckedMacrosOnLoad = bHasMacros;
+ }
+ 
+bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
+{
+    return pImpl->m_bHadCheckedMacrosOnLoad;
+}
+ 
+ void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
+ {
+diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx
+index 510c35d..a707bb7 100644
+--- a/sfx2/source/doc/objxtor.cxx
+++ b/sfx2/source/doc/objxtor.cxx
+@@ -237,6 +237,7 @@ SfxObjectShell_Impl::SfxObjectShell_Impl( SfxObjectShell& _rDocShell )
+     ,m_bAllowShareControlFileClean( true )
+     ,m_bConfigOptionsChecked( false )
+     ,m_bMacroCallsSeenWhileLoading( false )
+    ,m_bHadCheckedMacrosOnLoad( false )
+     ,lErr(ERRCODE_NONE)
+     ,nEventId ( SfxEventHintId::NONE )
+     ,nLoadedFlags ( SfxLoadedFlags::ALL )
+diff --git a/sfx2/source/inc/objshimp.hxx b/sfx2/source/inc/objshimp.hxx
+index 3d7b0b6..4afdd70 100644
+--- a/sfx2/source/inc/objshimp.hxx
+++ b/sfx2/source/inc/objshimp.hxx
+@@ -91,7 +91,8 @@ struct SfxObjectShell_Impl : public ::sfx2::IMacroDocumentAccess
+                         m_bSharedXMLFlag:1, // whether the document should be edited in shared mode
+                         m_bAllowShareControlFileClean:1, // whether the flag should be stored in xml file
+                         m_bConfigOptionsChecked:1, // whether or not the user options are checked after the Options dialog is closed.
+-                        m_bMacroCallsSeenWhileLoading:1; // whether or not the user options are checked after the Options dialog is closed.
+                        m_bMacroCallsSeenWhileLoading:1, // whether or not macro calls were seen when loading document.
+                        m_bHadCheckedMacrosOnLoad:1; // if document contained macros (or calls) when loaded
+ 
+     IndexBitSet         aBitSet;
+     ErrCode             lErr;
+-- 
+2.43.0
+
--- a/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
+++ b/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch
@ -0,0 +1,54 @@
+From eaa66eec69ec311b73521c6ce410a749c810298f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 20 Apr 2023 20:58:21 +0100
+Subject: [PATCH 3/3] assume IFrame script/macro support isn't needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+seems undocumented at least
+
+Change-Id: I316e4f4f25ddb7cf6b7bac4d856a721b987207a3
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151020
+Tested-by: Jenkins
+Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152150
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 4b679f8e16bc050bc0cc9fa9294413c8115ed239)
+---
+ sfx2/source/doc/iframe.cxx | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
+index fce6cb48ea08f..84d724f7c58f3 100644
+--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
+@@ -168,20 +168,16 @@ sal_Bool SAL_CALL IFrameObject::load(
+         uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( mxContext ) );
+         xTrans->parseStrict( aTargetURL );
+ 
+        INetURLObject aURLObject(aTargetURL.Complete);
+        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
+            return false;
+
+         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
+         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+ 
+-        if (INetURLObject(aTargetURL.Complete).GetProtocol() == INetProtocol::Macro)
+-        {
+-            if (pDoc && !pDoc->AdjustMacroMode())
+-                return false;
+-        }
+-
+         bool bUpdateAllowed(true);
+         if (pDoc)
+         {
+-            // perhaps should only check for file targets, but lets default to making it strong
+-            // unless there is a known need to distinguish
+             comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pDoc->getEmbeddedObjectContainer();
+             bUpdateAllowed = rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
+         }
+-- 
+2.41.0
+
--- a/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
+++ b/SOURCES/0003-xmlsecurity-replace-XSecParser-implementation.patch
--- a/SOURCES/0004-CVE-2021-25634.patch
+++ b/SOURCES/0004-CVE-2021-25634.patch
@ -0,0 +1,397 @@
+From 9ef423d4e7c85629772131b3216b98e17d7b8d7e Mon Sep 17 00:00:00 2001
+From: Michael Stahl <michael.stahl@allotropia.de>
+Date: Thu, 18 Feb 2021 19:22:31 +0100
+Subject: [PATCH 4/6] CVE-2021-25634
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+xmlsecurity: XSecParser confused about multiple timestamps
+
+LO writes timestamp both to dc:date and xades:SigningTime elements.
+
+The parser tries to avoid reading multiple dc:date, preferring the first
+one, but doesn't care about multiple xades:SigningTime, for undocumented
+reasons.
+
+Ideally something should check all read values for consistency.
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111160
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 4ab8d9c09a5873ca0aea56dafa1ab34758d52ef7)
+
+xmlsecurity: remove XSecController::setPropertyId()
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111252
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit d2a345e1163616fe3201ef1d6c758e2e819214e0)
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111908
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit abe77c4fcb9ea97d9fff07eaea6d8863bcba5b02)
+
+Change-Id: Ic018ee89797a1c8a4f870ae102af48006de930ef
+---
+ include/svl/sigstruct.hxx                    |  7 +-
+ xmlsecurity/inc/xsecctl.hxx                  |  5 +-
+ xmlsecurity/source/helper/ooxmlsecparser.cxx |  4 +-
+ xmlsecurity/source/helper/xsecctl.cxx        |  2 +-
+ xmlsecurity/source/helper/xsecparser.cxx     | 81 ++++++++++----------
+ xmlsecurity/source/helper/xsecparser.hxx     |  6 --
+ xmlsecurity/source/helper/xsecsign.cxx       |  4 +-
+ xmlsecurity/source/helper/xsecverify.cxx     | 39 ++++------
+ 8 files changed, 68 insertions(+), 80 deletions(-)
+
+diff --git a/include/svl/sigstruct.hxx b/include/svl/sigstruct.hxx
+index f6ee242c84d1..7a0296fa9fae 100644
+--- a/include/svl/sigstruct.hxx
+++ b/include/svl/sigstruct.hxx
+@@ -103,6 +103,9 @@ struct SignatureInformation
+     // XAdES EncapsulatedX509Certificate values
+     std::set<OUString> maEncapsulatedX509Certificates;
+ 
+    OUString ouSignatureId;
+    // signature may contain multiple time stamps - check they're consistent
+    bool hasInconsistentSigningTime = false;
+     //We also keep the date and time as string. This is done when this
+     //structure is created as a result of a XML signature being read.
+     //When then a signature is added or another removed, then the original
+@@ -115,8 +118,8 @@ struct SignatureInformation
+     //and the converted time is written back, then the string looks different
+     //and the signature is broken.
+     OUString ouDateTime;
+-    OUString ouSignatureId;
+-    OUString ouPropertyId;
+    /// The Id attribute of the <SignatureProperty> element that contains the <dc:date>.
+    OUString ouDateTimePropertyId;
+     /// Characters of the <dc:description> element inside the signature.
+     OUString ouDescription;
+     /// The Id attribute of the <SignatureProperty> element that contains the <dc:description>.
+diff --git a/xmlsecurity/inc/xsecctl.hxx b/xmlsecurity/inc/xsecctl.hxx
+index 351c94a2a3e6..7baa219fb13c 100644
+--- a/xmlsecurity/inc/xsecctl.hxx
+++ b/xmlsecurity/inc/xsecctl.hxx
+@@ -271,8 +271,8 @@ private:
+     void setGpgCertificate( OUString const & ouGpgCert );
+     void setGpgOwner( OUString const & ouGpgOwner );
+ 
+-    void setDate( OUString const & ouDate );
+-    void setDescription(const OUString& rDescription);
+    void setDate(OUString const& rId, OUString const& ouDate);
+    void setDescription(OUString const& rId, OUString const& rDescription);
+     void setCertDigest(const OUString& rCertDigest);
+     void setValidSignatureImage(const OUString& rValidSigImg);
+     void setInvalidSignatureImage(const OUString& rInvalidSigImg);
+@@ -283,7 +283,6 @@ public:
+ 
+ private:
+     void setId( OUString const & ouId );
+-    void setPropertyId( OUString const & ouPropertyId );
+ 
+     css::uno::Reference< css::xml::crypto::sax::XReferenceResolvedListener > prepareSignatureToRead(
+         sal_Int32 nSecurityId );
+diff --git a/xmlsecurity/source/helper/ooxmlsecparser.cxx b/xmlsecurity/source/helper/ooxmlsecparser.cxx
+index c22e8c2261bf..a200de60c07a 100644
+--- a/xmlsecurity/source/helper/ooxmlsecparser.cxx
+++ b/xmlsecurity/source/helper/ooxmlsecparser.cxx
+@@ -192,12 +192,12 @@ void SAL_CALL OOXMLSecParser::endElement(const OUString& rName)
+     }
+     else if (rName == "mdssi:Value")
+     {
+-        m_pXSecController->setDate(m_aMdssiValue);
+        m_pXSecController->setDate("", m_aMdssiValue);
+         m_bInMdssiValue = false;
+     }
+     else if (rName == "SignatureComments")
+     {
+-        m_pXSecController->setDescription(m_aSignatureComments);
+        m_pXSecController->setDescription("", m_aSignatureComments);
+         m_bInSignatureComments = false;
+     }
+     else if (rName == "X509IssuerName")
+diff --git a/xmlsecurity/source/helper/xsecctl.cxx b/xmlsecurity/source/helper/xsecctl.cxx
+index ab108d13c224..8d5ea68c768b 100644
+--- a/xmlsecurity/source/helper/xsecctl.cxx
+++ b/xmlsecurity/source/helper/xsecctl.cxx
+@@ -819,7 +819,7 @@ void XSecController::exportSignature(
+                 pAttributeList = new SvXMLAttributeList();
+                 pAttributeList->AddAttribute(
+                     "Id",
+-                    signatureInfo.ouPropertyId);
+                    signatureInfo.ouDateTimePropertyId);
+                 pAttributeList->AddAttribute(
+                     "Target",
+                     "#" + signatureInfo.ouSignatureId);
+diff --git a/xmlsecurity/source/helper/xsecparser.cxx b/xmlsecurity/source/helper/xsecparser.cxx
+index 5c92e5efa104..9cc9312b4d9f 100644
+--- a/xmlsecurity/source/helper/xsecparser.cxx
+++ b/xmlsecurity/source/helper/xsecparser.cxx
+@@ -978,6 +978,9 @@ class XSecParser::XadesSigningCertificateContext
+ class XSecParser::XadesSigningTimeContext
+     : public XSecParser::Context
+ {
+    private:
+        OUString m_Value;
+
+     public:
+         XadesSigningTimeContext(XSecParser & rParser,
+                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+@@ -985,20 +988,14 @@ class XSecParser::XadesSigningTimeContext
+         {
+         }
+ 
+-        virtual void StartElement(
+-            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
+-        {
+-            m_rParser.m_ouDate.clear();
+-        }
+-
+         virtual void EndElement() override
+         {
+-            m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
+            m_rParser.m_pXSecController->setDate("", m_Value);
+         }
+ 
+         virtual void Characters(OUString const& rChars) override
+         {
+-            m_rParser.m_ouDate += rChars;
+            m_Value += rChars;
+         }
+ };
+ 
+@@ -1104,35 +1101,20 @@ class XSecParser::DcDateContext
+     : public XSecParser::Context
+ {
+     private:
+-        bool m_isIgnore = false;
+        OUString & m_rValue;
+ 
+     public:
+         DcDateContext(XSecParser & rParser,
+-                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
+                OUString & rValue)
+             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
+            , m_rValue(rValue)
+         {
+         }
+ 
+-        virtual void StartElement(
+-            css::uno::Reference<css::xml::sax::XAttributeList> const& /*xAttrs*/) override
+-        {
+-            m_isIgnore = !m_rParser.m_ouDate.isEmpty();
+-        }
+-
+-        virtual void EndElement() override
+-        {
+-            if (!m_isIgnore)
+-            {
+-                m_rParser.m_pXSecController->setDate( m_rParser.m_ouDate );
+-            }
+-        }
+-
+         virtual void Characters(OUString const& rChars) override
+         {
+-            if (!m_isIgnore)
+-            {
+-                m_rParser.m_ouDate += rChars;
+-            }
+            m_rValue += rChars;
+         }
+ };
+ 
+@@ -1140,29 +1122,32 @@ class XSecParser::DcDescriptionContext
+     : public XSecParser::Context
+ {
+     private:
+-        OUString m_Value;
+        OUString & m_rValue;
+ 
+     public:
+         DcDescriptionContext(XSecParser & rParser,
+-                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+                std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap,
+                OUString & rValue)
+             : XSecParser::Context(rParser, std::move(pOldNamespaceMap))
+            , m_rValue(rValue)
+         {
+         }
+ 
+-        virtual void EndElement() override
+-        {
+-            m_rParser.m_pXSecController->setDescription(m_Value);
+-        }
+-
+         virtual void Characters(OUString const& rChars) override
+         {
+-            m_Value += rChars;
+            m_rValue += rChars;
+         }
+ };
+ 
+ class XSecParser::DsSignaturePropertyContext
+     : public XSecParser::Context
+ {
+    private:
+        enum class SignatureProperty { Unknown, Date, Description };
+        SignatureProperty m_Property = SignatureProperty::Unknown;
+        OUString m_Id;
+        OUString m_Value;
+
+     public:
+         DsSignaturePropertyContext(XSecParser & rParser,
+                 std::unique_ptr<SvXMLNamespaceMap> pOldNamespaceMap)
+@@ -1173,10 +1158,22 @@ class XSecParser::DsSignaturePropertyContext
+         virtual void StartElement(
+             css::uno::Reference<css::xml::sax::XAttributeList> const& xAttrs) override
+         {
+-            OUString const ouIdAttr(m_rParser.HandleIdAttr(xAttrs));
+-            if (!ouIdAttr.isEmpty())
+            m_Id = m_rParser.HandleIdAttr(xAttrs);
+        }
+
+        virtual void EndElement() override
+        {
+            switch (m_Property)
+             {
+-                m_rParser.m_pXSecController->setPropertyId( ouIdAttr );
+                case SignatureProperty::Unknown:
+                    SAL_INFO("xmlsecurity.helper", "Unknown property in ds:Object ignored");
+                    break;
+                case SignatureProperty::Date:
+                    m_rParser.m_pXSecController->setDate(m_Id, m_Value);
+                    break;
+                case SignatureProperty::Description:
+                    m_rParser.m_pXSecController->setDescription(m_Id, m_Value);
+                    break;
+             }
+         }
+ 
+@@ -1186,11 +1183,13 @@ class XSecParser::DsSignaturePropertyContext
+         {
+             if (nNamespace == XML_NAMESPACE_DC && rName == "date")
+             {
+-                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap));
+                m_Property = SignatureProperty::Date;
+                return std::make_unique<DcDateContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
+             }
+             if (nNamespace == XML_NAMESPACE_DC && rName == "description")
+             {
+-                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap));
+                m_Property = SignatureProperty::Description;
+                return std::make_unique<DcDescriptionContext>(m_rParser, std::move(pOldNamespaceMap), m_Value);
+             }
+             return XSecParser::Context::CreateChildContext(std::move(pOldNamespaceMap), nNamespace, rName);
+         }
+diff --git a/xmlsecurity/source/helper/xsecparser.hxx b/xmlsecurity/source/helper/xsecparser.hxx
+index 93efcb766e3e..7a0eb08bca28 100644
+--- a/xmlsecurity/source/helper/xsecparser.hxx
+++ b/xmlsecurity/source/helper/xsecparser.hxx
+@@ -97,12 +97,6 @@ private:
+     class DsSignatureContext;
+     class DsigSignaturesContext;
+ 
+-    /*
+-     * the following members are used to reserve the signature information,
+-     * including X509IssuerName, X509SerialNumber, and X509Certificate,etc.
+-     */
+-    OUString m_ouDate;
+-
+     std::stack<std::unique_ptr<Context>> m_ContextStack;
+     std::unique_ptr<SvXMLNamespaceMap> m_pNamespaceMap;
+ 
+diff --git a/xmlsecurity/source/helper/xsecsign.cxx b/xmlsecurity/source/helper/xsecsign.cxx
+index 4d1b89949feb..5ed23281f083 100644
+--- a/xmlsecurity/source/helper/xsecsign.cxx
+++ b/xmlsecurity/source/helper/xsecsign.cxx
+@@ -132,8 +132,8 @@ cssu::Reference< cssxc::sax::XReferenceResolvedListener > XSecController::prepar
+     if (nStorageFormat != embed::StorageFormats::OFOPXML)
+     {
+         internalSignatureInfor.signatureInfor.ouSignatureId = createId();
+-        internalSignatureInfor.signatureInfor.ouPropertyId = createId();
+-        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouPropertyId, -1, OUString() );
+        internalSignatureInfor.signatureInfor.ouDateTimePropertyId = createId();
+        internalSignatureInfor.addReference(SignatureReferenceType::SAMEDOCUMENT, digestID, internalSignatureInfor.signatureInfor.ouDateTimePropertyId, -1, OUString() );
+         size++;
+ 
+         if (bXAdESCompliantIfODF)
+diff --git a/xmlsecurity/source/helper/xsecverify.cxx b/xmlsecurity/source/helper/xsecverify.cxx
+index 1f7fa9ac8ca8..5f5840334254 100644
+--- a/xmlsecurity/source/helper/xsecverify.cxx
+++ b/xmlsecurity/source/helper/xsecverify.cxx
+@@ -321,7 +321,7 @@ void XSecController::setGpgOwner( OUString const & ouGpgOwner )
+     isi.signatureInfor.ouGpgOwner = ouGpgOwner;
+ }
+ 
+-void XSecController::setDate( OUString const & ouDate )
+void XSecController::setDate(OUString const& rId, OUString const& ouDate)
+ {
+     if (m_vInternalSignatureInformations.empty())
+     {
+@@ -329,17 +329,31 @@ void XSecController::setDate( OUString const & ouDate )
+         return;
+     }
+     InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
+    // there may be multiple timestamps in a signature - check them for consistency
+    if (!isi.signatureInfor.ouDateTime.isEmpty()
+        && isi.signatureInfor.ouDateTime != ouDate)
+    {
+        isi.signatureInfor.hasInconsistentSigningTime = true;
+    }
+     (void)utl::ISO8601parseDateTime( ouDate, isi.signatureInfor.stDateTime);
+     isi.signatureInfor.ouDateTime = ouDate;
+    if (!rId.isEmpty())
+    {
+        isi.signatureInfor.ouDateTimePropertyId = rId;
+    }
+ }
+ 
+-void XSecController::setDescription(const OUString& rDescription)
+void XSecController::setDescription(OUString const& rId, OUString const& rDescription)
+ {
+     if (m_vInternalSignatureInformations.empty())
+         return;
+ 
+     InternalSignatureInformation& rInformation = m_vInternalSignatureInformations.back();
+     rInformation.signatureInfor.ouDescription = rDescription;
+    if (!rId.isEmpty())
+    {
+        rInformation.signatureInfor.ouDescriptionPropertyId = rId;
+    }
+ }
+ 
+ void XSecController::setSignatureBytes(const uno::Sequence<sal_Int8>& rBytes)
+@@ -433,27 +447,6 @@ void XSecController::setId( OUString const & ouId )
+     isi.signatureInfor.ouSignatureId = ouId;
+ }
+ 
+-void XSecController::setPropertyId( OUString const & ouPropertyId )
+-{
+-    if (m_vInternalSignatureInformations.empty())
+-    {
+-        SAL_INFO("xmlsecurity.helper","XSecController::setPropertyId: no signature");
+-        return;
+-    }
+-    InternalSignatureInformation &isi = m_vInternalSignatureInformations.back();
+-
+-    if (isi.signatureInfor.ouPropertyId.isEmpty())
+-    {
+-        // <SignatureProperty> ID attribute is for the date.
+-        isi.signatureInfor.ouPropertyId = ouPropertyId;
+-    }
+-    else
+-    {
+-        // <SignatureProperty> ID attribute is for the description.
+-        isi.signatureInfor.ouDescriptionPropertyId = ouPropertyId;
+-    }
+-}
+-
+ /* public: for signature verify */
+ void XSecController::collectToVerify( const OUString& referenceId )
+ {
+-- 
+2.32.0
+
--- a/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
+++ b/SOURCES/0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
@ -0,0 +1,117 @@
+From 4cfd591942e4cfd3efc416bfac8e46e3580d37ba Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Wed, 23 Mar 2022 13:03:30 +0000
+Subject: [PATCH] add infobar to prompt to refresh to replace old format
+
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131976
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit bbd196ff82bda9f66b4ba32a412f10cefe6da60e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132307
+Reviewed-by: Sophie Gautier <sophi@libreoffice.org>
+Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
+(cherry picked from commit c5d01b11db3c83cb4a89d3b388d78e20dd3990b5)
+
+Change-Id: Id99cbf2b50a4ebf289dae6fc67e22e20afcda35b
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133906
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+---
+ include/sfx2/strings.hrc     |  2 ++
+ include/sfx2/viewfrm.hxx     |  1 +
+ sfx2/source/view/viewfrm.cxx | 40 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 43 insertions(+)
+
+diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
+index 1f21f0a0f186..1db36e733c0c 100644
+--- a/include/sfx2/strings.hrc
+++ b/include/sfx2/strings.hrc
+@@ -297,6 +297,8 @@
+ #define STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK   NC_("STR_SIGNATURE_NOTVALIDATED_PARTIAL_OK", "The certificate could not be validated and the document is only partially signed.")
+ #define STR_SIGNATURE_OK                        NC_("STR_SIGNATURE_OK", "This document is digitally signed and the signature is valid.")
+ #define STR_SIGNATURE_SHOW                      NC_("STR_SIGNATURE_SHOW", "Show Signatures")
+#define STR_REFRESH_MASTER_PASSWORD             NC_("STR_REFRESH_MASTER_PASSWORD", "The master password is stored in an outdated format, you should refresh it")
+#define STR_REFRESH_PASSWORD                    NC_("STR_REFRESH_PASSWORD", "Refresh Password")
+ 
+ #define STR_CLOSE_PANE                          NC_("STR_CLOSE_PANE", "Close Pane")
+ #define STR_SFX_DOCK                            NC_("STR_SFX_DOCK", "Dock")
+diff --git a/include/sfx2/viewfrm.hxx b/include/sfx2/viewfrm.hxx
+index fe336ba5f091..cc6a7dae7047 100644
+--- a/include/sfx2/viewfrm.hxx
+++ b/include/sfx2/viewfrm.hxx
+@@ -61,6 +61,7 @@ protected:
+     DECL_LINK(WhatsNewHandler, Button*, void);
+     DECL_LINK(SwitchReadOnlyHandler, Button*, void);
+     DECL_LINK(SignDocumentHandler, Button*, void);
+    DECL_DLLPRIVATE_LINK(RefreshMasterPasswordHdl, Button*, void);
+     SAL_DLLPRIVATE void KillDispatcher_Impl();
+ 
+     virtual                 ~SfxViewFrame() override;
+diff --git a/sfx2/source/view/viewfrm.cxx b/sfx2/source/view/viewfrm.cxx
+index 5a64599e5894..86e7d51bbfea 100644
+--- a/sfx2/source/view/viewfrm.cxx
+++ b/sfx2/source/view/viewfrm.cxx
+@@ -32,6 +32,7 @@
+ #include <com/sun/star/frame/XLoadable.hpp>
+ #include <com/sun/star/frame/XLayoutManager.hpp>
+ #include <com/sun/star/frame/XComponentLoader.hpp>
+#include <com/sun/star/task/PasswordContainer.hpp>
+ #include <officecfg/Office/Common.hxx>
+ #include <officecfg/Setup.hxx>
+ #include <toolkit/helper/vclunohelper.hxx>
+@@ -1390,6 +1391,24 @@ void SfxViewFrame::Notify( SfxBroadcaster& /*rBC*/, const SfxHint& rHint )
+                     batch->commit();
+                 }
+ 
+                if (officecfg::Office::Common::Passwords::HasMaster::get() &&
+                    officecfg::Office::Common::Passwords::StorageVersion::get() == 0)
+                {
+                    // master password stored in deprecated format
+                    VclPtr<SfxInfoBarWindow> pOldMasterPasswordInfoBar =
+                        AppendInfoBar("oldmasterpassword", "",
+                                      SfxResId(STR_REFRESH_MASTER_PASSWORD), InfobarType::DANGER, false);
+                    if (pOldMasterPasswordInfoBar)
+                    {
+                        VclPtrInstance<PushButton> const xBtn(&GetWindow());
+                        xBtn->SetText(SfxResId(STR_REFRESH_PASSWORD));
+                        xBtn->SetSizePixel(xBtn->GetOptimalSize());
+                        xBtn->SetClickHdl(LINK(this,
+                           SfxViewFrame, RefreshMasterPasswordHdl));
+                        pOldMasterPasswordInfoBar->addButton(xBtn);
+                    }
+                }
+
+                 // read-only infobar if necessary
+                 const SfxViewShell *pVSh;
+                 const SfxShell *pFSh;
+@@ -1565,6 +1584,27 @@ IMPL_LINK_NOARG(SfxViewFrame, SignDocumentHandler, Button*, void)
+     GetDispatcher()->Execute(SID_SIGNATURE);
+ }
+ 
+IMPL_LINK_NOARG(SfxViewFrame, RefreshMasterPasswordHdl, Button*, void)
+{
+    bool bChanged = false;
+    try
+    {
+        Reference< task::XPasswordContainer2 > xMasterPasswd(
+            task::PasswordContainer::create(comphelper::getProcessComponentContext()));
+
+        css::uno::Reference<css::frame::XFrame> xFrame = GetFrame().GetFrameInterface();
+        css::uno::Reference<css::awt::XWindow> xContainerWindow = xFrame->getContainerWindow();
+
+        uno::Reference<task::XInteractionHandler> xTmpHandler(task::InteractionHandler::createWithParent(comphelper::getProcessComponentContext(),
+                                                              xContainerWindow));
+        bChanged = xMasterPasswd->changeMasterPassword(xTmpHandler);
+    }
+    catch (const Exception&)
+    {}
+    if (bChanged)
+        RemoveInfoBar(u"oldmasterpassword");
+}
+
+ void SfxViewFrame::Construct_Impl( SfxObjectShell *pObjSh )
+ {
+     m_pImpl->bResizeInToOut = true;
+-- 
+2.37.1
+
--- a/SOURCES/0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch
+++ b/SOURCES/0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch
@ -0,0 +1,281 @@
+From 6a69b533227ae22d97824317f14dfa6991959101 Mon Sep 17 00:00:00 2001
+Message-ID: <6a69b533227ae22d97824317f14dfa6991959101.1703086328.git.erack@redhat.com>
+In-Reply-To: <82752ccba78ecdbf94908377ec022f68ba7d9d59.1703086328.git.erack@redhat.com>
+References: <82752ccba78ecdbf94908377ec022f68ba7d9d59.1703086328.git.erack@redhat.com>
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Wed, 15 Nov 2023 11:39:24 +0000
+Subject: [PATCH 3/4] reuse AllowedLinkProtocolFromDocument in writer
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
+
+This is a multi-part message in MIME format.
+--------------erAck-patch-parts
+Content-Type: text/plain; charset=UTF-8; format=fixed
+Content-Transfer-Encoding: 8bit
+
+
+reorg calc hyperlink check to reuse elsewhere
+
+Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)
+
+reuse AllowedLinkProtocolFromDocument in writer
+
+Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)
+
+combine these hyperlink dispatchers into one call
+
+Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
+Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)
+
+we can have just one LoadURL for writer
+
+Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
+Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159883
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159913
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Eike Rathke <erack@redhat.com>
+---
+ include/sfx2/objsh.hxx               |  7 +++--
+ sc/source/core/data/global.cxx       | 32 ++---------------------
+ sfx2/source/doc/objmisc.cxx          | 27 ++++++++++++++++++++
+ sw/source/uibase/shells/drwtxtex.cxx |  8 ++----
+ sw/source/uibase/wrtsh/wrtsh2.cxx    | 38 ++++++++++++++++++----------
+ 5 files changed, 60 insertions(+), 52 deletions(-)
+
+
+--------------erAck-patch-parts
+Content-Type: text/x-patch; name="0003-reuse-AllowedLinkProtocolFromDocument-in-writer.patch"
+Content-Transfer-Encoding: 8bit
+Content-Disposition: attachment; filename="0003-reuse-AllowedLinkProtocolFromDocument-in-writer.patch"
+
+diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
+index fde0dba3d7c9..79f22c978dcb 100644
+--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
+@@ -200,6 +200,9 @@ private:
+ 
+     SAL_DLLPRIVATE bool SaveTo_Impl(SfxMedium &rMedium, const SfxItemSet* pSet );
+ 
+    // true if the document had macros (or similar) on load to trigger warning user
+    SAL_DLLPRIVATE bool  GetHadCheckedMacrosOnLoad() const;
+
+ protected:
+                                 SfxObjectShell(SfxObjectCreateMode);
+                                 SfxObjectShell(SfxModelFlags);    // see sfxmodelfactory.hxx
+@@ -427,8 +430,8 @@ public:
+     void                        SetMacroCallsSeenWhileLoading();
+     bool                        GetMacroCallsSeenWhileLoading() const;
+ 
+-    // true if the document had macros (or similar) on load to trigger warning user
+-    bool                        GetHadCheckedMacrosOnLoad() const;
+    // true if this type of link, from a document, is allowed by the user to be passed to uno:OpenDoc
+    static bool                 AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent);
+ 
+     const css::uno::Sequence< css::beans::PropertyValue >& GetModifyPasswordInfo() const;
+     bool                        SetModifyPasswordInfo( const css::uno::Sequence< css::beans::PropertyValue >& aInfo );
+diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
+index 92caea1ea459..27c5a51a46c1 100644
+--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
+@@ -29,9 +29,7 @@
+ #include <sfx2/docfile.hxx>
+ #include <sfx2/dispatch.hxx>
+ #include <sfx2/objsh.hxx>
+-#include <sfx2/sfxresid.hxx>
+ #include <sfx2/sfxsids.hrc>
+-#include <sfx2/strings.hrc>
+ #include <sfx2/viewfrm.hxx>
+ #include <sfx2/viewsh.hxx>
+ #include <svl/intitem.hxx>
+@@ -856,34 +854,8 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
+             aUrlName = aNewUrlName;
+     }
+ 
+-    if (INetURLObject(aUrlName).IsExoticProtocol())
+-    {
+-        // Default to ignoring exotic protocols
+-        bool bAllow = false;
+-        if (pObjShell)
+-        {
+-            // If the document had macros when loaded then follow the allowed macro-mode
+-            if (pObjShell->GetHadCheckedMacrosOnLoad())
+-                bAllow = pObjShell->AdjustMacroMode();
+-            else // otherwise ask the user, defaulting to cancel
+-            {
+-                assert(pFrame && "if we have pObjShell we have pFrame");
+-                //Reuse URITools::onOpenURI warning string
+-                std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pFrame->GetFrameWeld(),
+-                                                               VclMessageType::Warning, VclButtonsType::YesNo,
+-                                                               SfxResId(STR_DANGEROUS_TO_OPEN)));
+-                xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+-                    INetURLObject::decode(aUrlName, INetURLObject::DecodeMechanism::Unambiguous)));
+-                xQueryBox->set_default_response(RET_NO);
+-                bAllow = xQueryBox->run() == RET_YES;
+-            }
+-        }
+-        if (!bAllow)
+-        {
+-            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
+-            return;
+-        }
+-    }
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetFrameWeld() : nullptr))
+        return;
+ 
+     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
+     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
+diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
+index ddf95eeafe5e..8c76c3f0f4d6 100644
+--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
+@@ -962,6 +962,33 @@ bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
+     return pImpl->m_bHadCheckedMacrosOnLoad;
+ }
+ 
+bool SfxObjectShell::AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent)
+{
+    if (!INetURLObject(rUrl).IsExoticProtocol())
+        return true;
+    // Default to ignoring exotic protocols
+    bool bAllow = false;
+    if (pObjShell)
+    {
+        // If the document had macros when loaded then follow the allowed macro-mode
+        if (pObjShell->GetHadCheckedMacrosOnLoad())
+            bAllow = pObjShell->AdjustMacroMode();
+        else // otherwise ask the user, defaulting to cancel
+        {
+            //Reuse URITools::onOpenURI warning string
+            std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pDialogParent,
+                                                           VclMessageType::Warning, VclButtonsType::YesNo,
+                                                           SfxResId(STR_DANGEROUS_TO_OPEN)));
+            xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+                INetURLObject::decode(rUrl, INetURLObject::DecodeMechanism::Unambiguous)));
+            xQueryBox->set_default_response(RET_NO);
+            bAllow = xQueryBox->run() == RET_YES;
+        }
+    }
+    SAL_WARN_IF(!bAllow, "sfx.appl", "SfxObjectShell::AllowedLinkProtocolFromDocument ignoring: " << rUrl);
+    return bAllow;
+}
+
+ void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
+ {
+     OUString aVersion;
+diff --git a/sw/source/uibase/shells/drwtxtex.cxx b/sw/source/uibase/shells/drwtxtex.cxx
+index c84ee7bd9af4..c51f501841ad 100644
+--- a/sw/source/uibase/shells/drwtxtex.cxx
+++ b/sw/source/uibase/shells/drwtxtex.cxx
+@@ -533,12 +533,8 @@ void SwDrawTextShell::Execute( SfxRequest &rReq )
+             const SvxFieldData* pField = pOLV->GetFieldAtCursor();
+             if (const SvxURLField* pURLField = dynamic_cast<const SvxURLField*>(pField))
+             {
+-                SfxStringItem aUrl(SID_FILE_NAME, pURLField->GetURL());
+-                SfxStringItem aTarget(SID_TARGETNAME, pURLField->GetTargetFrame());
+-                SfxBoolItem aNewView(SID_OPEN_NEW_VIEW, false);
+-                SfxBoolItem aBrowsing(SID_BROWSE, true);
+-                GetView().GetViewFrame()->GetDispatcher()->ExecuteList(
+-                    SID_OPENDOC, SfxCallMode::SYNCHRON, { &aUrl, &aTarget, &aNewView, &aBrowsing });
+                ::LoadURL(GetShell(), pURLField->GetURL(), LoadUrlFlags::NONE,
+                          pURLField->GetTargetFrame());
+             }
+         }
+         break;
+diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx
+index 1995e7133c4a..d781823e82ec 100644
+--- a/sw/source/uibase/wrtsh/wrtsh2.cxx
+++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
+@@ -501,30 +501,24 @@ bool SwWrtShell::ClickToINetGrf( const Point& rDocPt, LoadUrlFlags nFilter )
+     return bRet;
+ }
+ 
+-void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+-              const OUString& rTargetFrameName )
+static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
+                    const OUString& rTargetFrameName)
+ {
+-    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
+-    if( rURL.isEmpty() )
+-        return ;
+    SwDocShell* pDShell = rView.GetDocShell();
+    OSL_ENSURE( pDShell, "No DocShell?!");
+    SfxViewFrame* pViewFrame = rView.GetViewFrame();
+ 
+-    // The shell could be 0 also!!!!!
+-    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetFrameWeld()))
+         return;
+ 
+     // We are doing tiledRendering, let the client handles the URL loading,
+     // unless we are jumping to a TOC mark.
+     if (comphelper::LibreOfficeKit::isActive() && !rURL.startsWith("#"))
+     {
+-        rVSh.GetSfxViewShell()->libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
+        rView.libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
+         return;
+     }
+ 
+-    //A CursorShell is always a WrtShell
+-    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
+-
+-    SwDocShell* pDShell = rSh.GetView().GetDocShell();
+-    OSL_ENSURE( pDShell, "No DocShell?!");
+     OUString sTargetFrame(rTargetFrameName);
+     if (sTargetFrame.isEmpty() && pDShell)
+     {
+@@ -539,7 +533,6 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+     OUString sReferer;
+     if( pDShell && pDShell->GetMedium() )
+         sReferer = pDShell->GetMedium()->GetName();
+-    SfxViewFrame* pViewFrame = rSh.GetView().GetViewFrame();
+     SfxFrameItem aView( SID_DOCFRAME, pViewFrame );
+     SfxStringItem aName( SID_FILE_NAME, rURL );
+     SfxStringItem aTargetFrameName( SID_TARGETNAME, sTargetFrame );
+@@ -565,6 +558,23 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+             SfxCallMode::ASYNCHRON|SfxCallMode::RECORD );
+ }
+ 
+void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+              const OUString& rTargetFrameName )
+{
+    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
+    if( rURL.isEmpty() )
+        return ;
+
+    // The shell could be 0 also!!!!!
+    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+        return;
+
+    //A CursorShell is always a WrtShell
+    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
+
+    ::LoadURL(rSh.GetView(), rURL, nFilter, rTargetFrameName);
+}
+
+ void SwWrtShell::NavigatorPaste( const NaviContentBookmark& rBkmk,
+                                     const sal_uInt16 nAction )
+ {
+
+--------------erAck-patch-parts--
+
+
--- a/SOURCES/0005-CVE-2021-25633.patch
+++ b/SOURCES/0005-CVE-2021-25633.patch
--- a/SOURCES/0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch
+++ b/SOURCES/0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch
@ -0,0 +1,87 @@
+From 62ba88176c10469588e4bbb73cbf33889df08dbc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Wed, 22 Nov 2023 21:14:41 +0000
+Subject: [PATCH] reuse AllowedLinkProtocolFromDocument in impress/draw
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159884
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159914
+Reviewed-by: Eike Rathke <erack@redhat.com>
+
+erAck: backported to 6.4.7.2
+
+---
+ sd/source/ui/app/sdmod1.cxx | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/sd/source/ui/app/sdmod1.cxx b/sd/source/ui/app/sdmod1.cxx
+index 3d84ddb..8d42653 100644
+--- a/sd/source/ui/app/sdmod1.cxx
+++ b/sd/source/ui/app/sdmod1.cxx
+@@ -32,6 +32,7 @@
+ #include <sfx2/dispatch.hxx>
+ #include <sfx2/request.hxx>
+ #include <sfx2/templatedlg.hxx>
+#include <svl/stritem.hxx>
+ #include <editeng/eeitem.hxx>
+ 
+ #include <svx/svxids.hrc>
+@@ -193,26 +194,32 @@ void SdModule::Execute(SfxRequest& rReq)
+         {
+             bool bIntercept = false;
+             ::sd::DrawDocShell* pDocShell = dynamic_cast< ::sd::DrawDocShell *>( SfxObjectShell::Current() );
+-            if (pDocShell)
+            ::sd::ViewShell* pViewShell = pDocShell ? pDocShell->GetViewShell() : nullptr;
+            if (pViewShell)
+             {
+-                ::sd::ViewShell* pViewShell = pDocShell->GetViewShell();
+-                if (pViewShell)
+                if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
+                 {
+-                    if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
+                    // Prevent documents from opening while the slide
+                    // show is running, except when this request comes
+                    // from a shape interaction.
+                    if (rReq.GetArgs() == nullptr)
+                     {
+-                        // Prevent documents from opening while the slide
+-                        // show is running, except when this request comes
+-                        // from a shape interaction.
+-                        if (rReq.GetArgs() == nullptr)
+-                        {
+-                            bIntercept = true;
+-                        }
+                        bIntercept = true;
+                     }
+                 }
+             }
+ 
+             if (!bIntercept)
+             {
+                if (const SfxStringItem* pURLItem = rReq.GetArg<SfxStringItem>(SID_FILE_NAME))
+                {
+                    if (!pViewShell || !SfxObjectShell::AllowedLinkProtocolFromDocument(pURLItem->GetValue(),
+                                                                                        pViewShell->GetObjectShell(),
+                                                                                        pViewShell->GetFrameWeld()))
+                    {
+                        return;
+                    }
+                }
+                 SfxGetpApp()->ExecuteSlot(rReq, SfxGetpApp()->GetInterface());
+             }
+             else
+-- 
+2.43.0
+
--- a/SOURCES/0006-CVE-2023-6186-backporting.patch
+++ b/SOURCES/0006-CVE-2023-6186-backporting.patch
@ -0,0 +1,65 @@
+From a255a9c69d35df27e92349ea5bb9cb8d6c46d97f Mon Sep 17 00:00:00 2001
+From: rpmbuild <rpmbuild@fedoraproject.org>
+Date: Fri, 8 Mar 2024 17:51:24 +0100
+Subject: [PATCH] CVE-2023-6186 backporting
+
+Add dialog text string STR_DANGEROUS_TO_OPEN
+as per upstream commit 70009098fd70df021048c540d1796c928554b494
+
+SfxViewFrame doesn't have GetFrameWeld() yet, get from Window.
+---
+ include/sfx2/strings.hrc          | 1 +
+ sc/source/core/data/global.cxx    | 4 +++-
+ sw/source/uibase/wrtsh/wrtsh2.cxx | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
+index 1db36e7..29950ba 100644
+--- a/include/sfx2/strings.hrc
+++ b/include/sfx2/strings.hrc
+@@ -103,6 +103,7 @@
+ #define STR_GB                                  NC_("STR_GB", "GB")
+ #define STR_QUERY_LASTVERSION                   NC_("STR_QUERY_LASTVERSION", "Cancel all changes?")
+ #define STR_NO_WEBBROWSER_FOUND                 NC_("STR_NO_WEBBROWSER_FOUND", "Opening \"$(ARG1)\" failed with error code $(ARG2) and message: \"$(ARG3)\"\nMaybe no web browser could be found on your system. In that case, please check your Desktop Preferences or install a web browser (for example, Firefox) in the default location requested during the browser installation.")
+#define STR_DANGEROUS_TO_OPEN                   NC_("STR_DANGEROUS_TO_OPEN", "It might be dangerous to open \"$(ARG1)\".\nDo you really want to open it?")
+ #define STR_NO_ABS_URI_REF                      NC_("STR_NO_ABS_URI_REF", "\"$(ARG1)\" is not an absolute URL that can be passed to an external application to open it.")
+ #define STR_GID_INTERN                          NC_("STR_GID_INTERN", "Internal")
+ #define STR_GID_APPLICATION                     NC_("STR_GID_APPLICATION", "Application")
+diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
+index b16be6b..3295a38 100644
+--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
+@@ -37,6 +37,8 @@
+ #include <vcl/virdev.hxx>
+ #include <vcl/settings.hxx>
+ #include <vcl/svapp.hxx>
+#include <vcl/weld.hxx>
+#include <vcl/window.hxx>
+ #include <unotools/charclass.hxx>
+ #include <unotools/securityoptions.hxx>
+ #include <osl/diagnose.h>
+@@ -823,7 +825,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
+             aUrlName = aNewUrlName;
+     }
+ 
+-    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetFrameWeld() : nullptr))
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetWindow().GetFrameWeld() : nullptr))
+         return;
+ 
+     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
+diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx
+index 41f427a..543644d 100644
+--- a/sw/source/uibase/wrtsh/wrtsh2.cxx
+++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
+@@ -495,7 +495,7 @@ static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
+     OSL_ENSURE( pDShell, "No DocShell?!");
+     SfxViewFrame* pViewFrame = rView.GetViewFrame();
+ 
+-    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetFrameWeld()))
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetWindow().GetFrameWeld()))
+         return;
+ 
+     // We are doing tiledRendering, let the client handles the URL loading,
+-- 
+2.43.0
+
--- a/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
+++ b/SOURCES/0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
--- a/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
+++ b/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc
@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBEyzEr0BEADT441wUITsTwDA2nM3kmUhGrzTdxZB5xv/E1ZJCw63qWdmdTdW
+NZDfNDuLs4r2VjlEoA3xGK6jgnQvyAoNj0yiEbW/JedHHgOiVdXDlkgkY58myafT
+FXqDLzTXVrsNnay0GS8XrNjptZJPhEPBvNUdkqpA9B7RTkfaXj779Pf/AeFMZVLl
+UAci5RA0NNF910GHwoXT6SEv2PGoawsphnfmMVdKh9wz7asbtKXEmotCwX3k045x
+LsIVK5ANOi+BI9C3LkrrFJWw2XHqDW2ulwCJ0L5QNSjOuY/v8REODwIXamvvdZOz
+XBKSIzDOalJqFCHls3YlGyFw1knr6BAOmVOm32YtNTCLbVA/iK55fZWnUCjD3a4G
+xz4qpQYWfpxhOmlHpk5JkraSNHzCc7SB43DwcHF5ecXHttMhO8MoN/bAZBgCuLGF
+EwNvwFbDwIWo07mlv7wD8i1rtUCvLywJc5YL2PbjCLfB1Q4YzDX1EWnjKdnAsxxK
+ftrx1DFlxzUF+TaHbLTPttUcsWQaL8wITznoWIwdIWlo2woPgWIpUXMOYwYV31Oo
+fgmroHa3V4NOvkke09uhaZawg5yZCoRFohhfKPqT1ZrJ9SnRbW/WR3VTVY76ht5k
+RuV3eb2VWBmPU9zn56Tbe6dvFkBuzHH1JdECAqy1BzFcmQQFBebFzf1XAQARAQAB
+tEhMaWJyZU9mZmljZSBCdWlsZCBUZWFtIChDT0RFIFNJR05JTkcgS0VZKSA8YnVp
+bGRAZG9jdW1lbnRmb3VuZGF0aW9uLm9yZz6JAjcEEwEKACEFAkyzEr0CGwMFCwkI
+BwMFFQoJCAsFFgIDAQACHgECF4AACgkQ9DSh76/urqOc4w//X+74QlyRalcuLNw3
+oJKB1+1z6xxhhpwg1kw5cMMrGu0w0YoPvLDKaiS02DdkIaXDECcQTOoEh7/bYbZq
+6OtE1WyxqHYYOPK5yul5FRwZ5k5HZ7pDFcKCQ72UgWhz+QznRhgZ0jwEWl5Ln3rw
+JpSynIvTXHmQogId0xmcrNQPyckzzugGx4qZFinSOmDGwTgG14NU3vat2iek37Ph
+BLh5V8ohlEoccwwPejtKEWQudg0Q8K7uBuqLUhnJoZodEytqpOvtysuPtGxGXnmD
+7oXtBVEF3X6eFRXDIp81cx2isHK4Krf4z4T9KUimNLHjWRa+ZQtp2pZLHQlblfsn
+CUf6TYZ0Yi909EhcM/hxAgBZXellOCQ/8U2cJsTUyN5Dp1wbf6X0uK4uaed1/037
+EGLAO6PP6WQz6jWd1/hhsQ5oAmdjkzlMFEfKNeIIDuKMOjXcTvM8/KRXhufwICvS
+FBlSIveHfDFWCvOVgq0VjAY7NFMFKRUnRHB58qBamtyhOyscRIvT5QH8HYfUA/YN
+l9FguczYUIQi3t+H1hoHIywdtmRuhYx5WlIUe8FO9QD5RMPbBjVbkCYgdHdxgnJD
+KCoRGsoKlLB7UZc4Ak9j6plZbYtFRonm2MjU4zxblCFNuEqVQ0V/y6/OIGpBYF9Y
+aEAtTgEJd9OmmDCM3d8O0zZHYma5Ag0ETLMSvQEQAMDp0HxSDWd+2Od/aJutCMFe
+8tfw7+nP9gfHOCUqesb88QvRMJgVY6z1aNdMllxTKlsxUiuA6uNcrUAkzDp/qRWR
+58rWIO642PLifng3urJ1cDbSKC+K4RHpQC+hXllMKLqq8dwNy1LO4fPo9SdtUF4B
+ev6enKmo4yCiOGv2tvztPh9gMGYoDncaOsS0t2UPr2MMQIVUmmIzfJBkdOxbZiWO
+doeNbWsYJHQaO+Ahal6SjPHKzhdjeXhZzHl1vqeDkV4MXHprrOwXNXwPiEpkZe2O
+dc7yaMkQc0k8WRrfKHApbnwDx6Mi8HYaf+LvRq7P0eMO9osD1q44wQQvVzk199zp
+MMHS5/kAv7RBNmDOSJQIZ4zT4lzRDODjMf01Ljn02zon12GfJo0WbbpmLulta7uj
+HgMrUU54by8WPFGW0fljXiDX0EpkHhxUsUsfaNfBsFnE+sRxQjNF/ljvofkyApI2
+1OjtEa9krwvgDqaXsL+a2076OsoFpORlTZ30REb0eRS6rEt8M+7s4xTaA7GFxlY/
+N+bnaM8m+ItygfFHHW4H0wLbbgajDeooSTgaheVNF5V9HS0EkN4MNVvtJH7J6drd
+iR1QVhX87n7+JtQzTtCOyfeKjaB+kcbAm/2VOFOeHdig5+BygpXt3IixVq72xmGz
+h0jhY565MjXrqg5O3pvLABEBAAGJAh8EGAEKAAkFAkyzEr0CGwwACgkQ9DSh76/u
+rqPaeg//avI2/a94XlSYtSZb2hVdW3qa9AEypQurqtVrKJfEKFV+ZQBPXbPRy8Mz
+5LMEH1sfD6B4SVGIGJ8opSyieJkcKIke+GMekTWvSqDpFOgY2rw7eHNn/33ZJs3O
+zQOyWz8smE/AIM/5lyiVGuSlU7RjYncf1V9bIBc91q9Edqk4IYUo/7W+yafC0VW/
+8oHUFYjHNaujiOsEoLiXsh9Y0R/6Jxs6fvE4XbCANV/ecN5UX+9BBrNZNN/9GbNr
+6CYGZ57M2f1Pgywy/XvOnEPnJ8aWXUyGLqq34KvMPFPSOeAmFbkFEsB4mdDMFaDw
+rzziiZE/zS8/nKiH4X2JgmLgFsadEihdfYxeDcGbhREK/qA1f3bGnr1j05V07yko
+2FFZdiOr4OgiT5ymgwVUXQ2Aiz+J/C8URjfpcPxetmuDQT9AYfgmMKPNVXPFWuNQ
+dzN5GZbI+E1/cb5+uLNknvjngw2G4PR/4uPHX1HCSftlNawBqWzyun1k+B7/u3Oe
+FebWXcdqSmZuLQ7l0Pkuz/Nlp6M6cKpceL+9zCgaiR5+v9h94VvtXKd/mw9ZLACc
+VcOANiwCtsJP3lt7jRSHtkuUe6vUm5tLS582RfXxoI1BlPjNtG9xAQ3JKBHIXbal
+T18pAFO3t74cxg3h0iI1G51F3oL0DwILP2MBBmardVEp5CMnB/M=
+=1iQB
+-----END PGP PUBLIC KEY BLOCK-----
--- a/SPECS/libreoffice.spec
+++ b/SPECS/libreoffice.spec
@ -54,7 +54,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.2
-Release:        4%{?libo_prerelease}%{?dist}
+Release:        18%{?libo_prerelease}%{?dist}
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/

@ -213,7 +213,9 @@ BuildRequires: libnumbertext-devel

 # java stuff
 BuildRequires: ant
+%if 0%{?fedora}
 BuildRequires: bsh
+%endif
 BuildRequires: java-devel
 BuildRequires: junit
 BuildRequires: pentaho-reporting-flow-engine
@ -264,6 +266,42 @@ Patch22: 0005-cid-1460969-Uninitialized-scalar-field.patch
 Patch23: 0006-tdf-137897-scRetypePassInputDlg-re-allow-password-re.patch
 Patch24: 0007-tdf-137982-m_xFrame-is-already-disposed.patch
 Patch25: 0008-Resolves-tdf-137215-restore-original-modality-before.patch
+Patch26: 0001-rhbz-1882616-move-cursor-one-step-at-a-time-in-the-d.patch
+Patch27: 0001-rhbz-1980800-allow-convert-to-csv-to-write-each-shee.patch
+Patch28: 0001-Resolves-tdf-132739-two-style-tags-where-there-shoul.patch
+Patch29: 0001-backports-to-ease-CVE-backporting.patch
+Patch30: 0002-CVE-2021-25635.patch
+Patch31: 0003-xmlsecurity-replace-XSecParser-implementation.patch
+Patch32: 0004-CVE-2021-25634.patch
+Patch33: 0005-CVE-2021-25633.patch
+Patch34: 0006-xmlsecurity-replace-OOXMLSecParser-implementation.patch
+Patch35: 0001-Correctly-read-PNG-into-bitmaps-N32BitTcA.-formats-w.patch
+Patch36: 0001-Read-MOSDocumentLockFile-UTF-16-string-data-with-sam.patch
+Patch37: 0001-Convert-attribute-value-to-UTF-8-when-passing-it-to-.patch
+Patch38: 0001-Fix-endianness-issues-in-OOX-crypto-routines.patch
+Patch39: 0001-CVE-2021-25636.patch
+Patch40: 0001-CVE-2022-26305-compare-authors-using-Thumbprint.patch
+Patch41: 0002-CVE-2022-26307-make-hash-encoding-match-decoding.patch
+Patch42: 0003-CVE-2022-26306-add-Initialization-Vectors-to-passwor.patch
+Patch43: 0004-CVE-2022-2630-6-7-add-infobar-to-prompt-to-refresh-t.patch
+Patch44: 0001-CVE-2022-3140.patch
+Patch45: 0001-CVE-2022-38745.patch
+Patch46: 0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
+Patch47: 0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
+Patch48: 0003-Always-push-a-result-even-if-it-s-only-an-error.patch
+Patch49: 0001-set-Referer-on-loading-IFrames.patch
+Patch50: 0002-put-floating-frames-under-managed-links-control.patch
+Patch51: 0003-assume-IFrame-script-macro-support-isn-t-needed.patch
+Patch52: 0001-disable-script-dump.patch
+Patch53: 0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
+Patch54: 0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch
+Patch55: 0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch
+Patch56: 0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot.patch
+Patch57: 0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch
+Patch58: 0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch
+Patch59: 0006-CVE-2023-6186-backporting.patch
+Patch60: 0001-CVE-2024-3044-add-notify-for-script-use.patch
+Patch61: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch

 %if 0%{?rhel}
 # not upstreamed
@ -313,7 +351,9 @@ Summary: Core modules for LibreOffice
 Requires: %{name}-%{fontname}-fonts = %{epoch}:%{version}-%{release}
 Requires: %{name}-ure%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: %{name}-data = %{epoch}:%{version}-%{release}
+%ifnarch s390 s390x aarch64
 Requires: %{name}-plugin%{?_isa} = %{epoch}:%{version}-%{release}
+%endif
 Requires: liberation-sans-fonts, liberation-serif-fonts, liberation-mono-fonts
 Requires: dejavu-sans-fonts, dejavu-serif-fonts, dejavu-sans-mono-fonts
 Requires: google-crosextra-caladea-fonts, google-crosextra-carlito-fonts
@ -1016,6 +1056,15 @@ sed -i -e /CppunitTest_sw_uiwriter/d sw/Module_sw.mk
 sed -i -e /CppunitTest_sc_subsequent_filters_test/d sc/Module_sc.mk
 %endif
 sed -i -e /CppunitTest_sal_osl/d sal/Module_sal.mk
+%ifarch s390x
+sed -i -e /CppunitTest_dbaccess_hsqlbinary_import/d dbaccess/Module_dbaccess.mk
+sed -i -e /CppunitTest_vcl_svm_test/d vcl/Module_vcl.mk
+sed -i -e /CustomTarget_uno_test/d testtools/Module_testtools.mk
+sed -i -e /CppunitTest_sw_htmlexport/d sw/Module_sw.mk
+%endif
+# Broken with system nss. See also upstream commit ac519af951541b7313a4c98e1bee463bf47356be
+sed -i -e '/^\s*CPPUNIT_TEST(testInsertCertificate_PEM_ODT);/d' desktop/qa/desktop_lib/test_desktop_lib.cxx
+sed -i -e '/^\s*CPPUNIT_TEST(testInsertCertificate_PEM_DOCX);/d' desktop/qa/desktop_lib/test_desktop_lib.cxx

 git commit -q -a -m 'temporarily disable failing tests'

@ -1061,7 +1110,7 @@ SMP_MFLAGS=%{?_smp_mflags}
 SMP_MFLAGS=$[${SMP_MFLAGS/-j/}]

 %if 0%{?flatpak}
-%define flatpakoptions --with-boost-libdir=%{_libdir} --with-beanshell-jar=/app/share/java/bsh.jar --with-commons-logging-jar=/app/share/java/commons-logging.jar --with-flute-jar=/app/share/java/flute.jar --with-jfreereport-jar=/app/share/java/flow-engine.jar --with-libbase-jar=/app/share/java/libbase.jar --with-libfonts-jar=/app/share/java/libfonts.jar --with-libformula-jar=/app/share/java/libformula.jar --with-liblayout-jar=/app/share/java/liblayout.jar --with-libloader-jar=/app/share/java/libloader.jar --with-librepository-jar=/app/share/java/librepository.jar --with-libserializer-jar=/app/share/java/libserializer.jar --with-libxml-jar=/app/share/java/libxml.jar --with-sac-jar=/app/share/java/sac.jar FIREBIRDCONFIG=%{_libdir}/fb_config QT4INC=%{_includedir}
+%define flatpakoptions --with-boost-libdir=%{_libdir} --with-beanshell-jar=/app/share/java/bsh.jar --with-commons-logging-jar=/app/share/java/commons-logging.jar --with-external-dict-dir=/app/share/myspell --with-external-hyph-dir=/app/share/hyphen --with-external-thes-dir=/app/share/mythes --with-flute-jar=/app/share/java/flute.jar --with-jdk-home=/app/lib/jvm/java-1.8.0-openjdk --with-jfreereport-jar=/app/share/java/flow-engine.jar --with-libbase-jar=/app/share/java/libbase.jar --with-libfonts-jar=/app/share/java/libfonts.jar --with-libformula-jar=/app/share/java/libformula.jar --with-liblayout-jar=/app/share/java/liblayout.jar --with-libloader-jar=/app/share/java/libloader.jar --with-librepository-jar=/app/share/java/librepository.jar --with-libserializer-jar=/app/share/java/libserializer.jar --with-libxml-jar=/app/share/java/libxml.jar --with-sac-jar=/app/share/java/sac.jar FIREBIRDCONFIG=%{_libdir}/fb_config QT4INC=%{_includedir}
 %endif

 # TODO: enable coinmp?
@ -1107,7 +1156,13 @@ touch autogen.lastrun

 ulimit -c unlimited || true

-make verbose=true build-nocheck
+if ! make verbose=true build-nocheck; then
+    echo "build attempt 1 failed"
+    if ! make verbose=true build-nocheck; then
+        echo "build attempt 2 failed"
+        make verbose=true GMAKE_OPTIONS=-rj1 build-nocheck
+    fi
+fi

 #generate the icons and mime type stuff
 export DESTDIR=../output
@ -1333,7 +1388,12 @@ for file in *.desktop; do
        $file
 done
 # rhbz#186515 do not show startcenter
-sed -i -e /NoDisplay/s/false/true/ startcenter.desktop
+desktop-file-edit --set-key=NoDisplay --set-value=true startcenter.desktop
+%ifarch s390 s390x aarch64
+for app in base calc draw impress math startcenter writer xsltfilter; do
+    desktop-file-edit --set-key=NoDisplay --set-value=true $app.desktop
+done
+%endif
 # relocate the .desktop and icon files
 install -m 0755 -d %{buildroot}%{_datadir}/applications
 for app in base calc draw impress math startcenter writer xsltfilter; do
@ -1466,6 +1526,7 @@ appstream-util replace-screenshots %{buildroot}%{_datadir}/metainfo/libreoffice-
 # org.libreoffice.LibreOffice.appdata.xml; first create the single file:
 solenv/bin/assemble-flatpak-appdata-step1.sh \
 %{buildroot}%{_datadir}/metainfo/ 0
+%if 0%{?fedora}
 # ...then update the screenshots in the single file (see above):
 appstream-util replace-screenshots \
 %{buildroot}%{_datadir}/metainfo/org.libreoffice.LibreOffice.appdata.xml \
@ -1474,6 +1535,7 @@ appstream-util replace-screenshots \
 https://raw.githubusercontent.com/hughsie/fedora-appstream/master/screenshots-extra/libreoffice-calc/a.png \
 https://raw.githubusercontent.com/hughsie/fedora-appstream/master/screenshots-extra/libreoffice-draw/a.png \
 https://raw.githubusercontent.com/hughsie/fedora-appstream/master/screenshots-extra/libreoffice-impress/a.png
+%endif
 # ...then append the original files to the single file:
 solenv/bin/assemble-flatpak-appdata-step2.sh \
 %{buildroot}%{_datadir}/metainfo/ %{buildroot}%{_datadir}/metainfo/
@ -1493,8 +1555,8 @@ for jar in %{buildroot}%{baseinstdir}/program/classes/*.jar; do
 done

 %check
-%ifnarch ppc64 s390x aarch64 armv7hl
-make
+%ifnarch ppc64 aarch64 armv7hl
+make unitcheck slowcheck
 # we don't need this anymore
 rm -f %{buildroot}%{baseinstdir}/program/classes/smoketest.jar
 %endif
@ -2246,6 +2308,62 @@ done
 %{_includedir}/LibreOfficeKit

 %changelog
+* Thu Aug 15 2024 Eike Rathke <erack@redhat.com> - 1:6.4.7.2-18
+- Fix CVE-2024-6472 remove ability to trust not validated macro signatures in
+  high security
+
+* Fri Jun 07 2024 Eike Rathke <erack@redhat.com> - 1:6.4.7.2-17
+- Fix CVE-2024-3044 add notify for script use
+
+* Mon Mar 11 2024 Eike Rathke <erack@redhat.com> - 1:6.4.7.2-16
+- Fix CVE-2023-6185 escape url passed to gstreamer
+- Fix CVE-2023-6186 check link target protocols
+
+* Mon Jun 19 2023 Stephan Bergmann <sbergman@redhat.com> - 1:6.4.7.2-15
+- Resolves: rhbz#2210191 CVE-2023-0950 Array Index UnderFlow in Calc Formula
+  Parsing
+- Resolves: rhbz#2210195 CVE-2023-2255 libreoffice: Remote documents loaded
+  without prompt via IFrame
+- Resolves: rhbz#2208509 CVE-2023-1183 libreoffice: Arbitrary File Write
+
+* Wed Apr 12 2023 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-14
+- Resolves: rhbz#2182390 CVE-2022-38745 Empty entry in Java class path
+
+* Mon Nov 21 2022 Stephan Bergmann <sbergman@redhat.com> - 1:6.4.7.2-13
+- Resolves: rhbz#2031681 Failure saving to smb share
+
+* Fri Oct 14 2022 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-12
+- Resolves: rhbz#2118928 CVE-2022-26305 Untrusted Macros
+- Resolves: rhbz#2118924 CVE-2022-26307 Weak Master Keys
+- Resolves: rhbz#2118920 CVE-2022-26306 Static Initialization Vector
+- Resolves: rhbz#2134702 CVE-2022-3140 Macro URL arbitrary script execution
+
+* Mon Mar 07 2022 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-11
+- Resolves: rhbz#2060559 CVE-2021-25636
+
+* Mon Feb 07 2022 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-10
+- Related: rhbz#2029810  bump n-v-r
+
+* Mon Jan 31 2022 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-9
+- Related: rhbz#2029810 set NoDisplay=true for .desktop on s390x/aarch64
+- Related: rhbz#2029810 don't Require any vclplug for s390x/aarch64
+
+* Tue Dec 07 2021 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-8
+- Resolves: rhbz#2029810 enable make check on s390x
+
+* Fri Oct 15 2021 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-7
+- Resolves: rhbz#2013858 CVE-2021-25633
+- Resolves: rhbz#2014215 CVE-2021-25634
+- Resolves: rhbz#2014209 CVE-2021-25635
+
+* Mon Sep 06 2021 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-6
+- Resolves: rhbz#1980800 allow convert to csv to write each sheet to
+  separate file
+- Resolves: rhbz#1992695 two style tags where there should be one
+
+* Wed Feb 03 2021 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-5
+- Resolves: rhbz#1924619 bad insertion of emoji
+
 * Mon Nov 09 2020 Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-4
 - Resolves: rhbz#1889801 rebuild for poppler