From a255a9c69d35df27e92349ea5bb9cb8d6c46d97f Mon Sep 17 00:00:00 2001 From: rpmbuild Date: Fri, 8 Mar 2024 17:51:24 +0100 Subject: [PATCH] CVE-2023-6186 backporting Add dialog text string STR_DANGEROUS_TO_OPEN as per upstream commit 70009098fd70df021048c540d1796c928554b494 SfxViewFrame doesn't have GetFrameWeld() yet, get from Window. --- include/sfx2/strings.hrc | 1 + sc/source/core/data/global.cxx | 4 +++- sw/source/uibase/wrtsh/wrtsh2.cxx | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc index 1db36e7..29950ba 100644 --- a/include/sfx2/strings.hrc +++ b/include/sfx2/strings.hrc @@ -103,6 +103,7 @@ #define STR_GB NC_("STR_GB", "GB") #define STR_QUERY_LASTVERSION NC_("STR_QUERY_LASTVERSION", "Cancel all changes?") #define STR_NO_WEBBROWSER_FOUND NC_("STR_NO_WEBBROWSER_FOUND", "Opening \"$(ARG1)\" failed with error code $(ARG2) and message: \"$(ARG3)\"\nMaybe no web browser could be found on your system. In that case, please check your Desktop Preferences or install a web browser (for example, Firefox) in the default location requested during the browser installation.") +#define STR_DANGEROUS_TO_OPEN NC_("STR_DANGEROUS_TO_OPEN", "It might be dangerous to open \"$(ARG1)\".\nDo you really want to open it?") #define STR_NO_ABS_URI_REF NC_("STR_NO_ABS_URI_REF", "\"$(ARG1)\" is not an absolute URL that can be passed to an external application to open it.") #define STR_GID_INTERN NC_("STR_GID_INTERN", "Internal") #define STR_GID_APPLICATION NC_("STR_GID_APPLICATION", "Application") diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx index b16be6b..3295a38 100644 --- a/sc/source/core/data/global.cxx +++ b/sc/source/core/data/global.cxx @@ -37,6 +37,8 @@ #include #include #include +#include +#include #include #include #include @@ -823,7 +825,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno aUrlName = aNewUrlName; } - if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetFrameWeld() : nullptr)) + if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetWindow().GetFrameWeld() : nullptr)) return; SfxStringItem aUrl( SID_FILE_NAME, aUrlName ); diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx index 41f427a..543644d 100644 --- a/sw/source/uibase/wrtsh/wrtsh2.cxx +++ b/sw/source/uibase/wrtsh/wrtsh2.cxx @@ -495,7 +495,7 @@ static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter, OSL_ENSURE( pDShell, "No DocShell?!"); SfxViewFrame* pViewFrame = rView.GetViewFrame(); - if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetFrameWeld())) + if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, pViewFrame->GetWindow().GetFrameWeld())) return; // We are doing tiledRendering, let the client handles the URL loading, -- 2.43.0