Differential D12732 Diff 35381 src/dolphinviewcontainer.cpp

Changeset View

Standalone View

View Options

src/dolphinviewcontainer.cpp

Show First 20 Lines • Show All 102 Lines • ▼ Show 20 Line(s)68{
103 connect(m_searchBox, &DolphinSearchBox::closeRequest, this, &DolphinViewContainer::closeSearchBox); 103​ connect(m_searchBox, &DolphinSearchBox::closeRequest, this, &DolphinViewContainer::closeSearchBox);
104 connect(m_searchBox, &DolphinSearchBox::searchRequest, this, &DolphinViewContainer::startSearching); 104​ connect(m_searchBox, &DolphinSearchBox::searchRequest, this, &DolphinViewContainer::startSearching);
105 connect(m_searchBox, &DolphinSearchBox::returnPressed, this, &DolphinViewContainer::requestFocus); 105​ connect(m_searchBox, &DolphinSearchBox::returnPressed, this, &DolphinViewContainer::requestFocus);
106 106​
107 m_messageWidget = new KMessageWidget(this); 107​ m_messageWidget = new KMessageWidget(this);
108 m_messageWidget->setCloseButtonVisible(true); 108​ m_messageWidget->setCloseButtonVisible(true);
109 m_messageWidget->hide(); 109​ m_messageWidget->hide();
110 110​
111​#ifndef Q_OS_WIN
112​ if (getuid() == 0) {
zzagUnsubmitted
Done

Why snake case?

zzag: Why snake case?
113​
114​ // We must be logged in as the root user; show a big scary warning
115​ showMessage(i18n("Running Dolphin as root can be dangerous. Please be careful."), Warning);
116​ }
117​#endif
118​
111 m_view = new DolphinView(url, this); 119​ m_view = new DolphinView(url, this);
112 connect(m_view, &DolphinView::urlChanged, 120​ connect(m_view, &DolphinView::urlChanged,
113 m_urlNavigator, &KUrlNavigator::setLocationUrl); 121​ m_urlNavigator, &KUrlNavigator::setLocationUrl);
114 connect(m_view, &DolphinView::urlChanged, 122​ connect(m_view, &DolphinView::urlChanged,
115 m_messageWidget, &KMessageWidget::hide); 123​ m_messageWidget, &KMessageWidget::hide);
116 connect(m_view, &DolphinView::writeStateChanged, 124​ connect(m_view, &DolphinView::writeStateChanged,
117 this, &DolphinViewContainer::writeStateChanged); 125​ this, &DolphinViewContainer::writeStateChanged);
118 connect(m_view, &DolphinView::requestItemInfo, 126​ connect(m_view, &DolphinView::requestItemInfo,
119 this, &DolphinViewContainer::showItemInfo); 127​ this, &DolphinViewContainer::showItemInfo);
120 connect(m_view, &DolphinView::itemActivated, 128​ connect(m_view, &DolphinView::itemActivated,
graesslinUnsubmitted
Not Done

If you show a message you are owned. That's the problem when running applications on X11 as root. Just opening the connection is sufficient to get owned. In my scratch repos you can find an example application to execute arbitrary commands through a dolphin running as root. See: https://cgit.kde.org/scratch/graesslin/exploit-dophin-root-x11.git/

The warning in the gui is too late.

graesslin: If you show a message you are owned. That's the problem when running applications on X11 as…
121 this, &DolphinViewContainer::slotItemActivated); 129​ this, &DolphinViewContainer::slotItemActivated);
122 connect(m_view, &DolphinView::itemsActivated, 130​ connect(m_view, &DolphinView::itemsActivated,
123 this, &DolphinViewContainer::slotItemsActivated); 131​ this, &DolphinViewContainer::slotItemsActivated);
124 connect(m_view, &DolphinView::redirection, 132​ connect(m_view, &DolphinView::redirection,
125 this, &DolphinViewContainer::redirect); 133​ this, &DolphinViewContainer::redirect);
126 connect(m_view, &DolphinView::directoryLoadingStarted, 134​ connect(m_view, &DolphinView::directoryLoadingStarted,
127 this, &DolphinViewContainer::slotDirectoryLoadingStarted); 135​ this, &DolphinViewContainer::slotDirectoryLoadingStarted);
128 connect(m_view, &DolphinView::directoryLoadingCompleted, 136​ connect(m_view, &DolphinView::directoryLoadingCompleted,
▲ Show 20 Lines • Show All 593 Lines • Show Last 20 Lines