Remove handling of privilege operation confirmation prompts from KIO::Job
ClosedPublic
Actions

Authored by chinmoyr on Feb 16 2018, 3:01 AM.

Details

Reviewers

Commits

R241:8b34864135f8: Remove handling of privilege operation confirmation prompts from KIO::Job

Summary

Letting KIO::Job handle these prompts is pointless because an application can always choose not to show these prompts
(by connecting privilegeOperationRequested signal to an empty slot) thus compromising security.

Test Plan

All the tests in privilegejobtest pass.

Diff Detail

Repository

R241 KIO

Branch

master

Lint

No Linters Available

Unit

No Unit Test Coverage

chinmoyr created this revision.Feb 16 2018, 3:01 AM

Restricted Application added a project: Frameworks. · View Herald TranscriptFeb 16 2018, 3:01 AM

Restricted Application added a subscriber: Frameworks. · View Herald Transcript

chinmoyr requested review of this revision.Feb 16 2018, 3:01 AM

chinmoyr edited the test plan for this revision. (Show Details)Feb 16 2018, 3:16 AM

dfaure added inline comments.Feb 16 2018, 8:36 AM

src/core/job.cpp
328 ↗	(On Diff #27315)	This overwrites m_data everytime, so it might as well be a local variable.
src/core/job_p.h
92 ↗	(On Diff #27315)	Is this variable really necessary? It seems to me that we'd better off without it.

removed m_data

chinmoyr added a dependent revision: D10568: Handle privilege operation confirmation prompts in SlaveBase.Feb 18 2018, 5:13 PM

chinmoyr mentioned this in T8075: Fix security issues with KAuth support in KIO.Feb 25 2018, 11:44 AM

dfaure requested changes to this revision.Mar 1 2018, 7:13 AM

dfaure added inline comments.

src/core/job.cpp
269	This feels like C code ;)
271	Either declare a var here, or return that directly (after swapping with next statement of course).
329	And here you can declare another QByteArray, more locally.

This revision now requires changes to proceed.Mar 1 2018, 7:13 AM

fix issue with variable declaration

dfaure accepted this revision.Mar 4 2018, 10:19 AM

This revision is now accepted and ready to land.Mar 4 2018, 10:19 AM

Closed by commit R241:8b34864135f8: Remove handling of privilege operation confirmation prompts from KIO::Job (authored by chinmoyr). · Explain WhyApr 3 2018, 5:11 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

			Path	Packages
M			src/core/job.cpp (142 lines)
M			src/core/job_p.h (5 lines)
M			src/core/simplejob.cpp (2 lines)
M			src/core/slavebase.cpp (20 lines)

Diff	ID	Base	Description	Created	Lint	Unit
Base			Base
Diff 1	27315	0f8c2d7		Feb 16 2018, 3:01 AM	★	★
Diff 2	27478	0f8c2d7	removed m_data	Feb 18 2018, 3:52 PM	★	★
Diff 3	28539	0f8c2d7	fix issue with variable declaration	Mar 4 2018, 4:10 AM	★	★
Diff 4	31224	ae42918	R241:8b34864135f87257d6d090ce7dd3a5f995c56076	Apr 3 2018, 5:10 PM	★	★

Commit	Tree	Parents	Author	Summary	Date
2a943cfd334b	6e3b174b642d	0f8c2d7922ca	Chinmoy Ranjan Pradhan	Remove handling of privilege operation confirmation prompts from KIO::Job (Show More…)	Feb 16 2018, 2:15 AM

Status	Author	Revision
Closed	chinmoyr	D10824 Delete IdleSlave having temporary authorization
Closed	chinmoyr	D10822 Store temporary authorization status in IdleSlave
Abandoned	chinmoyr	D10641 Revoke temporary authorization of KIO slave before sending status to IdleSlave
Abandoned	chinmoyr	D10638 [KAuth] Implement revokeTemporaryAuthorization in Polkit1Backend
Abandoned	chinmoyr	D10636 Add support for revoking temporary authorization in KAuth
Closed	chinmoyr	D10820 Send slave's polkit authorization status to the host
Closed	chinmoyr	D11010 Add MSG_SLAVE_STATUS_V2 to slave interface
Closed	chinmoyr	D10437 Update file ioslave's temporary authorization list
Closed	chinmoyr	D10818 Store PolicyKit action which the slave is authorized to perform
Closed	chinmoyr	D10568 Handle privilege operation confirmation prompts in SlaveBase
Closed	chinmoyr	D10567 Remove handling of privilege operation confirmation prompts from KIO::Job