diff options
author | Slávek Banko <slavek.banko@axis.cz> | 2019-08-08 02:45:03 +0200 |
---|---|---|
committer | Slávek Banko <slavek.banko@axis.cz> | 2019-08-09 02:34:55 +0200 |
commit | f41c1bba8b7221acf2f226ab7249057f1d9559b5 (patch) | |
tree | 21f86b4319dd0a0006f2610798f8cbcdcdf02399 /kdecore/kcompletion.cpp | |
parent | 3888dcd3dbefe399a6374e59c331c442fb984e0f (diff) | |
download | tdelibs-f41c1bba8b7221acf2f226ab7249057f1d9559b5.tar.gz tdelibs-f41c1bba8b7221acf2f226ab7249057f1d9559b5.zip |
Security: remove support for $(...) in config keys with [$e] marker.
It is very unclear at this point what a valid use case for this feature
would possibly be. The old documentation only mentions $(hostname) as
an example, which can be done with $HOSTNAME instead.
Note that $(...) is still supported in Exec lines of desktop files,
this does not require [$e] anyway (and actually works better without it,
otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
Based on KDE Frameworks 5 kconfig patch for CVE-2019-14744.
This resolves issue #45.
Signed-off-by: Slávek Banko <slavek.banko@axis.cz>
(cherry picked from commit 1074eb033654bd5462677ffe694eda7805390284)
Diffstat (limited to 'kdecore/kcompletion.cpp')
0 files changed, 0 insertions, 0 deletions