Note: I restricted access to Krusader project members. If the issue isn't considered severe enough this review can be made public.
The scenario here is a user who one way or another executed malware. This malware will be restricted by user's privileges until in can hijack a sudo session and seize full control of the computer. Krusader currently makes it unnecessarily easy for it because kdesu path is configured. So the malware can change the configuration (only user's privileges requires) to point to its own kdesu look-alike. Next time the user does something like "Start root mode Krusader" it steals the password and can do whatever it needs.
The only way to prevent this is not relying on user-specific configuration in order to locate kdesu, which is what my patch does. I assume that it will work on non-Ubuntu distributions as well. Only issue I noticed with my current solution: if KDE was compiled with a different value for CMAKE_INSTALL_PREFIX than Krusader then kdesu won't be found. In that case KDE_INSTALL_FULL_LIBEXECDIR_KF5 needs to be overridden via cmake parameters.
Elevation prompts running with user's privileges are generally problematic, malware applications might try to mess with them - like making them crash and reading the root password from the core dump. I'm not convinced that kdesu protects against potential manipulation effectively but at least it tries, so the core dump issue is covered. kdesudo on the other hand implements the naive approach without any protection whatsoever. This project also appears abandoned so I essentially reverted D4645. For reference, the issue wasn't that Ubuntu doesn't have kdesu, it's merely not in PATH.
This change is only the first step. User actions are using kdesu without going through krsevices. Krusader path shouldn't be configured either. And there are probably more issues. In the end, what we are doing here is making the attacker's job harder and less likely to go unnoticed. But in theory malware could even install its own malicious Krusader fork - an application file in user's home directory can make sure that it runs instead of the real thing.