StarMirror/qTox
1
0
Fork 0
mirror of https://github.com/qTox/qTox.git synced 2024-03-22 14:00:36 +08:00
Code Issues Projects Releases Wiki Activity

Use blacklist for executables, explicitly run executables with QProcess to work around KDE4.4 security measure which disallows running executables

Browse Source
This commit is contained in:
TheLastProject 2015-02-22 13:21:42 +01:00
parent eb8527675c
commit 695bd74ce5
4 changed files with 18 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/chatlog/content/filetransferwidget.cpp
View File

@ -429,8 +429,7 @@ void FileTransferWidget::handleButton(QPushButton *btn)
if(btn->objectName() == "ok")
{
if (Widget::confirmExecutableOpen(QFileInfo(fileInfo.filePath)))
QDesktopServices::openUrl(QUrl("file://" + fileInfo.filePath, QUrl::TolerantMode));
Widget::confirmExecutableOpen(QFileInfo(fileInfo.filePath));
}
else if (btn->objectName() == "dir")
{

8
src/widget/form/filesform.cpp
View File

@ -20,7 +20,6 @@
#include <QFileInfo>
#include <QUrl>
#include <QDebug>
#include <QDesktopServices>
FilesForm::FilesForm()
: QObject()
@ -82,10 +81,5 @@ void FilesForm::onFileActivated(QListWidgetItem* item)
{
ListWidgetItem* tmp = dynamic_cast<ListWidgetItem*> (item);
if (!Widget::confirmExecutableOpen(QFileInfo(tmp->path)))
return;
QUrl url = QUrl::fromLocalFile(tmp->path);
qDebug() << "Opening '" << url << "'";
QDesktopServices::openUrl(url);
Widget::confirmExecutableOpen(QFileInfo(tmp->path));
}

20
src/widget/widget.cpp
View File

@ -59,6 +59,8 @@
#include <QByteArray>
#include <QImageReader>
#include <QList>
#include <QDesktopServices>
#include <QProcess>
#include <tox/tox.h>
#ifdef Q_OS_ANDROID
@ -498,17 +500,25 @@ void Widget::onTransferClicked()
activeChatroomWidget = nullptr;
}
bool Widget::confirmExecutableOpen(const QFileInfo file)
void Widget::confirmExecutableOpen(const QFileInfo file)
{
if (file.isExecutable())
static const QStringList dangerousExtensions = { "app", "bat", "com", "cpl", "dmg", "exe", "hta", "jar", "js", "jse", "lnk", "msc", "msh", "msh1", "msh1xml", "msh2", "msh2xml", "mshxml", "msi", "msp", "pif", "ps1", "ps1xml", "ps2", "ps2xml", "psc1", "psc2", "py", "reg", "scf", "sh", "src", "vb", "vbe", "vbs", "ws", "wsc", "wsf", "wsh" };
if (dangerousExtensions.contains(file.suffix()))
{
if(!GUI::askQuestion(tr("Executable file", "popup title"), tr("You have asked qTox to open an executable file. Executable files can potentially damage your computer. Are you sure want to open this file?", "popup text"), false, true))
{
return false;
return;
}
// The user wants to run this file, so make it executable and run it
QFile(file.filePath()).setPermissions(file.permissions() | QFile::ExeOwner | QFile::ExeUser | QFile::ExeGroup | QFile::ExeOther);
QProcess::startDetached(file.filePath());
}
else
{
QDesktopServices::openUrl(QUrl("file://" + file.filePath(), QUrl::TolerantMode));
}
return true;
}
void Widget::onIconClick(QSystemTrayIcon::ActivationReason reason)

2
src/widget/widget.h
View File

@ -70,7 +70,7 @@ public:
virtual void changeEvent(QEvent *event);
virtual void resizeEvent(QResizeEvent *event);
static bool confirmExecutableOpen(const QFileInfo file);
static void confirmExecutableOpen(const QFileInfo file);
void clearAllReceipts();
void reloadHistory();