basctl/source/basicide/moduldlg.cxx                       |   55 ++++---
 bin/check-elf-dynamic-objects                             |    2 
 configure.ac                                              |   10 +
 download.lst                                              |    4 
 editeng/source/editeng/impedit.cxx                        |   20 +-
 external/curl/ExternalPackage_curl.mk                     |    2 
 external/curl/ExternalProject_curl.mk                     |    2 
 external/curl/UnpackedTarball_curl.mk                     |    1 
 external/curl/curl-7.26.0_win-proxy.patch                 |   12 -
 external/curl/curl-debug.patch.1                          |   11 -
 framework/source/jobs/job.cxx                             |   25 ++-
 framework/source/services/autorecovery.cxx                |   17 ++
 include/vcl/pdfwriter.hxx                                 |    3 
 m4/libo_externals.m4                                      |    2 
 sc/inc/document.hxx                                       |    5 
 sc/qa/extras/scpdfexport.cxx                              |   14 +
 sc/qa/extras/testdocuments/forcepoint97.xlsx              |binary
 sc/qa/uitest/calc_tests9/tdf123877.py                     |   52 +++++++
 sc/qa/uitest/data/tdf123877.xlsx                          |binary
 sc/source/core/data/documen2.cxx                          |    1 
 sc/source/core/data/formulacell.cxx                       |    3 
 sc/source/core/tool/editutil.cxx                          |   15 +-
 sc/source/core/tool/interpr1.cxx                          |   12 +
 sc/source/ui/docshell/docsh.cxx                           |   13 +
 sc/source/ui/view/output2.cxx                             |    7 
 sd/source/ui/dlg/BulletAndPositionDlg.cxx                 |    9 -
 sd/source/ui/inc/BulletAndPositionDlg.hxx                 |    1 
 svl/source/crypto/cryptosign.cxx                          |   27 +++
 sw/qa/extras/layout/data/tdf123163-1.docx                 |binary
 sw/qa/extras/layout/layout.cxx                            |    6 
 sw/qa/extras/ooxmlexport/data/tdf148455_1.docx            |binary
 sw/qa/extras/ooxmlexport/data/tdf148455_2.docx            |binary
 sw/qa/extras/ooxmlexport/ooxmlexport17.cxx                |   24 +++
 sw/qa/extras/uiwriter/uiwriter.cxx                        |   38 +++++
 sw/source/core/doc/DocumentContentOperationsManager.cxx   |    5 
 sw/source/core/docnode/node.cxx                           |    6 
 sw/source/core/layout/fly.cxx                             |    4 
 sw/source/filter/ww8/docxattributeoutput.cxx              |    9 +
 sw/source/uibase/uiview/viewling.cxx                      |   10 +
 sw/uiconfig/swriter/ui/statisticsinfopage.ui              |    1 
 toolkit/source/helper/formpdfexport.cxx                   |   33 ++++
 unotest/source/cpp/macros_test.cxx                        |    3 
 vcl/inc/pdf/pdfwriter_impl.hxx                            |    3 
 vcl/qa/cppunit/pdfexport/data/tdf148442.odt               |binary
 vcl/qa/cppunit/pdfexport/data/tdf148706.odt               |binary
 vcl/qa/cppunit/pdfexport/pdfexport.cxx                    |  102 ++++++++++++++
 vcl/qt5/QtTransferable.cxx                                |    5 
 vcl/quartz/salgdi.cxx                                     |   20 ++
 vcl/source/filter/itiff/itiff.cxx                         |    1 
 vcl/source/gdi/pdfwriter_impl.cxx                         |   89 ++++++++++--
 vcl/unx/gtk3/gtkinst.cxx                                  |   10 +
 writerfilter/source/dmapper/DomainMapper_Impl.cxx         |   10 +
 xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx |    7 
 53 files changed, 623 insertions(+), 88 deletions(-)

New commits:
commit 25c5d53778914e73c8c42aa6735f43810cfd9d1c
Author:     László Németh <[email protected]>
AuthorDate: Mon May 16 16:05:59 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:17 2022 +0200

    tdf#123877 sc XLSX: don't freeze during saving recovery
    
    file by asking password re-typing unstoppably. Instead
    of this, skip recovery file saving, if the document
    contains password hashes which haven't been supported
    by the "calc8" filter of the recovery file (which
    triggered the "Re-type password" dialog).
    
    Solved problems:
    
    – Asking for passwords during a non-interactive
      background process.
    
    – A single Cancel didn't close the "Re-type password" dialog
      window, only pressing three times at least (according to the
      value of RETRY_STORE_ON_MIGHT_FULL_DISC_USEFULL), but
      waiting for the password for a while could result a
      frozen "Re-type password" dialog, where only retyping or
      removing the password(s) were the escape routes.
    
    – Re-typing the password required the password (but modifying
      the original document doesn't require this).
    
    – Removing the password resulted in loss of the protection
      after saving the original XLSX document.
    
    Add a UI test to keep the "Re-type password" dialog during Save As.
    
    Note: because of the regression reported in tdf#145757, it needs
    to wait 10 min for saving the recovery file, yet, despite the
    changed time in Tools->Options->Load/Save->General.
    
    Change-Id: Icc6ee4d67048cdf15ab75ef8e2ee8f1709cdd4c2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134409
    Tested-by: László Németh <[email protected]>
    Reviewed-by: László Németh <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134493
    Tested-by: Jenkins

diff --git a/framework/source/services/autorecovery.cxx 
b/framework/source/services/autorecovery.cxx
index ebcae2a0862b..69b729f29076 100644
--- a/framework/source/services/autorecovery.cxx
+++ b/framework/source/services/autorecovery.cxx
@@ -55,6 +55,7 @@
 #include <com/sun/star/util/XCloseable.hpp>
 #include <com/sun/star/awt/XWindow2.hpp>
 #include <com/sun/star/task/XStatusIndicatorFactory.hpp>
+#include <com/sun/star/task/ErrorCodeIOException.hpp>
 #include <com/sun/star/lang/IndexOutOfBoundsException.hpp>
 #include <com/sun/star/lang/XTypeProvider.hpp>
 #include <com/sun/star/lang/XServiceInfo.hpp>
@@ -84,6 +85,7 @@
 #include <tools/diagnose_ex.h>
 #include <unotools/tempfile.hxx>
 #include <ucbhelper/content.hxx>
+#include <svtools/sfxecode.hxx>
 
 #include <vcl/weld.hxx>
 #include <osl/file.hxx>
@@ -3051,10 +3053,23 @@ void AutoRecovery::implts_saveOneDoc(const OUString&
             nRetry = 0;
 #endif // TRIGGER_FULL_DISC_CHECK
         }
-        catch(const css::uno::Exception&)
+        catch(const css::uno::Exception& rException)
         {
             bError = true;
 
+            // skip saving XLSX with protected sheets, if their passwords 
haven't supported yet
+            if ( rException.Message.startsWith("SfxBaseModel::impl_store") )
+            {
+                const css::task::ErrorCodeIOException& pErrorCodeIOException =
+                    static_cast<const 
css::task::ErrorCodeIOException&>(rException);
+                if ( static_cast<ErrCode>(pErrorCodeIOException.ErrCode) == 
ERRCODE_SFX_WRONGPASSWORD )
+                {
+                    // stop and remove the bad temporary file, instead of 
filling the disk with them
+                    bError = false;
+                    break;
+                }
+            }
+
             // a) FULL DISC seems to be the problem behind                     
         => show error and retry it forever (e.g. retry=300)
             // b) unknown problem (may be locking problem)                     
         => reset RETRY value to more useful value(!) (e.g. retry=3)
             // c) unknown problem (may be locking problem) + 1..2 repeating 
operations  => throw the original exception to force generation of a stacktrace 
!
diff --git a/sc/qa/uitest/calc_tests9/tdf123877.py 
b/sc/qa/uitest/calc_tests9/tdf123877.py
new file mode 100644
index 000000000000..5162f88d9b78
--- /dev/null
+++ b/sc/qa/uitest/calc_tests9/tdf123877.py
@@ -0,0 +1,52 @@
+# -*- tab-width: 4; indent-tabs-mode: nil; py-indent-offset: 4 -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+from uitest.framework import UITestCase
+from uitest.uihelper.calc import enter_text_to_cell
+from uitest.uihelper.common import get_state_as_dict, get_url_for_data_file
+from uitest.uihelper.common import select_by_text
+from libreoffice.uno.propertyvalue import mkPropertyValues
+from org.libreoffice.unotest import systemPathToFileUrl
+from tempfile import TemporaryDirectory
+import os.path
+
+from uitest.framework import UITestCase
+from uitest.uihelper.common import get_state_as_dict, get_url_for_data_file
+from libreoffice.uno.propertyvalue import mkPropertyValues
+from libreoffice.calc.document import get_cell_by_position
+
+
+class tdf123877(UITestCase):
+
+    def test_tdf123877(self):
+
+        xFilePath = get_url_for_data_file("tdf123877.xlsx")
+
+        with self.ui_test.load_file(xFilePath) as document:
+
+            # Save the XLSX document as ODS with a sheet protected with an 
unsupported hash format
+            with self.ui_test.execute_dialog_through_command(".uno:SaveAs", 
close_button="") as xSaveDialog:
+                xFileName = xSaveDialog.getChild("file_name")
+                xFileName.executeAction("TYPE", 
mkPropertyValues({"KEYCODE":"CTRL+A"}))
+                xFileName.executeAction("TYPE", 
mkPropertyValues({"KEYCODE":"BACKSPACE"}))
+                xFileName.executeAction("TYPE", mkPropertyValues({"TEXT": 
xFilePath}))
+                xFileTypeCombo = xSaveDialog.getChild("file_type")
+                select_by_text(xFileTypeCombo, "ODF Spreadsheet (.ods)")
+
+                xOpen = xSaveDialog.getChild("open")
+
+                with self.ui_test.execute_dialog_through_action(xOpen, 
"CLICK", close_button="") as xRetypePasswordDialog:
+                    # hash error dialog is still displayed (only disabled for 
the recovery file)
+                    xCancel = xRetypePasswordDialog.getChild("cancel")
+
+                    with self.ui_test.execute_dialog_through_action(xCancel, 
"CLICK", close_button="ok"):
+                    # Write error dialog is displayed
+                        pass
+
+# vim: set shiftwidth=4 softtabstop=4 expandtab:
diff --git a/sc/qa/uitest/data/tdf123877.xlsx b/sc/qa/uitest/data/tdf123877.xlsx
new file mode 100644
index 000000000000..64167ca474fb
Binary files /dev/null and b/sc/qa/uitest/data/tdf123877.xlsx differ
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
index 052be5984a16..91321209ce6a 100644
--- a/sc/source/ui/docshell/docsh.cxx
+++ b/sc/source/ui/docshell/docsh.cxx
@@ -139,6 +139,8 @@
 #include <vector>
 
 #include <comphelper/lok.hxx>
+#include <svtools/sfxecode.hxx>
+#include <unotools/pathoptions.hxx>
 
 using namespace com::sun::star;
 using ::com::sun::star::uno::Reference;
@@ -1810,6 +1812,17 @@ bool ScDocShell::SaveAs( SfxMedium& rMedium )
         bNeedsRehash = ScPassHashHelper::needsPassHashRegen(m_aDocument, 
PASSHASH_SHA256);
     }
 
+    // skip saving recovery file instead of showing re-type password dialog 
window
+    if ( bNeedsRehash && rMedium.GetFilter()->GetFilterName() == "calc8" &&
+            // it seems, utl::MediaDescriptor::PROP_AUTOSAVEEVENT is true at 
Save As, too,
+            // so check the backup path
+            rMedium.GetName().startsWith( SvtPathOptions().GetBackupPath() ) )
+    {
+        SAL_WARN("sc.filter", "Should re-type password for own format, won't 
export recovery file");
+        rMedium.SetError(ERRCODE_SFX_WRONGPASSWORD);
+        return false;
+    }
+
     if (pViewShell && bNeedsRehash)
     {
         if (!pViewShell->ExecuteRetypePassDlg(PASSHASH_SHA1))
commit c3923e2b06be36ba4aaa6c9cd66ac1778981aaf0
Author:     Vasily Melenchuk <[email protected]>
AuthorDate: Mon May 16 21:21:51 2022 +0300
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    tdf#148455 docx import/export: improvements to lvlOverride
    
    On save LO was just emitting w:lvlOverride to actual level
    where override does happen. But MS Word won't accept override
    for next level if there are no overrides for previous ones.
    
    For example, if we are overriding level 3 we should also emit
    empty lvlOverride for levels 0-2.
    
    Provided fix did cause some problems on DOCX import: overrides
    were applied to current level, but in this context current !=
    actual level where override did happen.
    
    Change-Id: Ia00dd9a5990f7f122027e8126f411642c32da189
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134411
    Tested-by: Jenkins
    Tested-by: Gabor Kelemen <[email protected]>
    Reviewed-by: Thorsten Behrens <[email protected]>
    (cherry picked from commit 198381eb32edcc3e82d0f23df65f0804a08b44e6)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134452
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/qa/extras/ooxmlexport/data/tdf148455_1.docx 
b/sw/qa/extras/ooxmlexport/data/tdf148455_1.docx
new file mode 100644
index 000000000000..295d3ee744c7
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/tdf148455_1.docx 
differ
diff --git a/sw/qa/extras/ooxmlexport/data/tdf148455_2.docx 
b/sw/qa/extras/ooxmlexport/data/tdf148455_2.docx
new file mode 100644
index 000000000000..3cde58ce5a77
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/tdf148455_2.docx 
differ
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport17.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport17.cxx
index 58b7a4845aec..0b359f3d2555 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport17.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport17.cxx
@@ -512,6 +512,30 @@ DECLARE_OOXMLEXPORT_TEST(testTdf144668, "tdf144668.odt")
     CPPUNIT_ASSERT_EQUAL(OUString("[001]"), getProperty<OUString>(xPara2, 
"ListLabelString"));
 }
 
+DECLARE_OOXMLEXPORT_TEST(testTdf148455_1, "tdf148455_1.docx")
+{
+    uno::Reference<beans::XPropertySet> xPara2(getParagraph(3, u"1.1.1"), 
uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(OUString("1.1.1."), getProperty<OUString>(xPara2, 
"ListLabelString"));
+}
+
+DECLARE_OOXMLEXPORT_TEST(testTdf148455_2, "tdf148455_2.docx")
+{
+    xmlDocUniquePtr pXmlDoc = parseExport("word/document.xml");
+    if (!pXmlDoc)
+       return; // initial import, no further checks
+
+    // Find list id for restarted list
+    sal_Int32 nListId = getXPath(pXmlDoc, 
"/w:document/w:body/w:p[3]/w:pPr/w:numPr/w:numId", "val").toInt32();
+
+    xmlDocUniquePtr pNumberingDoc = parseExport("word/numbering.xml");
+
+    // Ensure we have empty lvlOverride for levels 0 - 1
+    getXPath(pNumberingDoc, "/w:numbering/w:num[@w:numId='" + 
OString::number(nListId) +"']/w:lvlOverride[@w:ilvl='0']", "");
+    getXPath(pNumberingDoc, "/w:numbering/w:num[@w:numId='" + 
OString::number(nListId) +"']/w:lvlOverride[@w:ilvl='1']", "");
+    // And normal overrride for level 2
+    getXPath(pNumberingDoc, "/w:numbering/w:num[@w:numId='" + 
OString::number(nListId) +"']/w:lvlOverride[@w:ilvl='2']/w:startOverride", 
"val");
+}
+
 CPPUNIT_TEST_FIXTURE(Test, testTdf147978enhancedPathABVW)
 {
     load(DATA_DIRECTORY, "tdf147978_enhancedPath_commandABVW.odt");
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index 322c8e896658..ea8ca12f3dc2 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -7836,6 +7836,7 @@ void DocxAttributeOutput::OverrideNumberingDefinition(
     SwNumRule const& rAbstractRule = 
*(*m_rExport.m_pUsedNumTable)[nAbstractNum - 1];
     sal_uInt8 const nLevels = static_cast<sal_uInt8>(rRule.IsContinusNum()
         ? WW8ListManager::nMinLevel : WW8ListManager::nMaxLevel);
+    sal_uInt8 nPreviousOverrideLevel = 0;
     for (sal_uInt8 nLevel = 0; nLevel < nLevels; ++nLevel)
     {
         const auto levelOverride = rLevelOverrides.find(nLevel);
@@ -7845,6 +7846,14 @@ void DocxAttributeOutput::OverrideNumberingDefinition(
         // or we have a level numbering override
         if (bListsAreDifferent || levelOverride != rLevelOverrides.end())
         {
+            // If there are "gaps" in w:lvlOverride numbers, MS Word can have 
issues with numbering.
+            // So we need to emit empty override tokens up to current one.
+            while (nPreviousOverrideLevel < nLevel)
+            {
+                m_pSerializer->singleElementNS(XML_w, XML_lvlOverride, 
FSNS(XML_w, XML_ilvl), OString::number(nPreviousOverrideLevel));
+                nPreviousOverrideLevel++;
+            }
+
             m_pSerializer->startElementNS(XML_w, XML_lvlOverride, FSNS(XML_w, 
XML_ilvl), OString::number(nLevel));
 
             if (bListsAreDifferent)
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx 
b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index e0eac791f26f..250d21a5c466 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -2269,9 +2269,15 @@ void DomainMapper_Impl::finishParagraph( const 
PropertyMapPtr& pPropertyMap, con
                                     }
                                 }
                             }
-                            if (pList->GetCurrentLevel())
+
+                            sal_Int16 nCurrentLevel = GetListLevel(pEntry, 
pPropertyMap);
+                            if (nCurrentLevel == -1)
+                                nCurrentLevel = 0;
+
+                            const ListLevel::Pointer pListLevel = 
pList->GetLevel(nCurrentLevel);
+                            if (pListLevel)
                             {
-                                sal_Int16 nOverrideLevel = 
pList->GetCurrentLevel()->GetStartOverride();
+                                sal_Int16 nOverrideLevel = 
pListLevel->GetStartOverride();
                                 if (nOverrideLevel != -1 && 
m_aListOverrideApplied.find(nListId) == m_aListOverrideApplied.end())
                                 {
                                     // Apply override: we have override 
instruction for this level
commit be291cabdc4452e535490ece8b4db9ca58859543
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue May 17 16:28:20 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    Resolves: tdf#145722 don't propose MOVE from AcceptDrop if not asked for 
MOVE
    
    announce to dnd that tree supports COPY and MOVE, but on accepting a drop
    return MOVE only if that's something the AcceptDrop has set as desirable.
    
    a) makes ctrl+dnd to select 'copy' work for gtk, including gtk on wayland
    b) makes gen correctly draw its copy dnd icon.
    
    git show -w
    
    Change-Id: Ie985f8c9201634afc5ae717fd2aef0dbc18a39e4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134440
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/basctl/source/basicide/moduldlg.cxx 
b/basctl/source/basicide/moduldlg.cxx
index 582a08740d28..0471b2b2eefe 100644
--- a/basctl/source/basicide/moduldlg.cxx
+++ b/basctl/source/basicide/moduldlg.cxx
@@ -246,6 +246,10 @@ private:
         if (!pSource)
             return DND_ACTION_NONE;
 
+        // tdf#145722 only return a DND_ACTION_MOVE possibility if that
+        // is requested as an option
+        const bool bCheckForMove = rEvt.mnAction & DND_ACTION_MOVE;
+
         sal_Int8 nMode = DND_ACTION_NONE;
 
         std::unique_ptr<weld::TreeIter> xEntry(pSource->make_iterator());
@@ -255,28 +259,31 @@ private:
             if (nDepth >= 2)
             {
                 nMode = DND_ACTION_COPY;
-                EntryDescriptor aDesc = 
m_rTreeView.GetEntryDescriptor(xEntry.get());
-                const ScriptDocument& aDocument( aDesc.GetDocument() );
-                const OUString& aLibName( aDesc.GetLibName() );
-                // allow MOVE mode only for libraries, which are not readonly
-                Reference< script::XLibraryContainer2 > xModLibContainer( 
aDocument.getLibraryContainer( E_SCRIPTS ), UNO_QUERY );
-                Reference< script::XLibraryContainer2 > xDlgLibContainer( 
aDocument.getLibraryContainer( E_DIALOGS ), UNO_QUERY );
-                if ( !( ( xModLibContainer.is() && 
xModLibContainer->hasByName( aLibName ) && xModLibContainer->isLibraryReadOnly( 
aLibName ) ) ||
-                        ( xDlgLibContainer.is() && 
xDlgLibContainer->hasByName( aLibName ) && xDlgLibContainer->isLibraryReadOnly( 
aLibName ) ) ) )
+                if (bCheckForMove)
                 {
-                    // Only allow copy for localized libraries
-                    bool bAllowMove = true;
-                    if ( xDlgLibContainer.is() && xDlgLibContainer->hasByName( 
aLibName ) )
+                    EntryDescriptor aDesc = 
m_rTreeView.GetEntryDescriptor(xEntry.get());
+                    const ScriptDocument& aDocument( aDesc.GetDocument() );
+                    const OUString& aLibName( aDesc.GetLibName() );
+                    // allow MOVE mode only for libraries, which are not 
readonly
+                    Reference< script::XLibraryContainer2 > xModLibContainer( 
aDocument.getLibraryContainer( E_SCRIPTS ), UNO_QUERY );
+                    Reference< script::XLibraryContainer2 > xDlgLibContainer( 
aDocument.getLibraryContainer( E_DIALOGS ), UNO_QUERY );
+                    if ( !( ( xModLibContainer.is() && 
xModLibContainer->hasByName( aLibName ) && xModLibContainer->isLibraryReadOnly( 
aLibName ) ) ||
+                            ( xDlgLibContainer.is() && 
xDlgLibContainer->hasByName( aLibName ) && xDlgLibContainer->isLibraryReadOnly( 
aLibName ) ) ) )
                     {
-                        // Get StringResourceManager
-                        Reference< container::XNameContainer > xDialogLib( 
aDocument.getLibrary( E_DIALOGS, aLibName, true ) );
-                        Reference< XStringResourceManager > xSourceMgr =
-                            
LocalizationMgr::getStringResourceFromDialogLibrary( xDialogLib );
-                        if( xSourceMgr.is() )
-                            bAllowMove = ( 
xSourceMgr->getLocales().getLength() == 0 );
+                        // Only allow copy for localized libraries
+                        bool bAllowMove = true;
+                        if ( xDlgLibContainer.is() && 
xDlgLibContainer->hasByName( aLibName ) )
+                        {
+                            // Get StringResourceManager
+                            Reference< container::XNameContainer > xDialogLib( 
aDocument.getLibrary( E_DIALOGS, aLibName, true ) );
+                            Reference< XStringResourceManager > xSourceMgr =
+                                
LocalizationMgr::getStringResourceFromDialogLibrary( xDialogLib );
+                            if( xSourceMgr.is() )
+                                bAllowMove = ( 
xSourceMgr->getLocales().getLength() == 0 );
+                        }
+                        if( bAllowMove )
+                            nMode |= DND_ACTION_MOVE;
                     }
-                    if( bAllowMove )
-                        nMode |= DND_ACTION_MOVE;
                 }
             }
         }
@@ -569,6 +576,9 @@ ObjectPage::ObjectPage(weld::Container* pParent, const 
OString &rName, BrowseMod
     }
 
     m_xDropTarget.reset(new SbTreeListBoxDropTarget(*m_xBasicBox));
+    // tdf#145722 explicitly claim COPY and MOVE are options
+    rtl::Reference<TransferDataContainer> xHelper(new TransferDataContainer);
+    m_xBasicBox->get_widget().enable_drag_source(xHelper, DND_ACTION_COPYMOVE);
 
     m_xBasicBox->connect_editing(LINK(this, ObjectPage, EditingEntryHdl),
                                  LINK(this, ObjectPage, EditedEntryHdl));
commit e854bfa3faaf907cf64d55e0803ec10d8579452c
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue May 17 15:56:17 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    Related: tdf#145722 need to clone userdata if we copy a module/dialog
    
    otherwise we double-free it, so do what TreeListBox::CloneEntry used to
    before it was dropped as unused at
    
    commit 4a72d6f474b105cdaa7a570b1f199475cc64bb14
    Date:   Tue Feb 11 13:50:50 2020 +0000
    
        drop newly unused TreeListBox
    
    Change-Id: I127511ef4f752cf9a2da26a541e6f1add2a9cf9a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134439
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/basctl/source/basicide/moduldlg.cxx 
b/basctl/source/basicide/moduldlg.cxx
index 2e3c8c2530d1..582a08740d28 100644
--- a/basctl/source/basicide/moduldlg.cxx
+++ b/basctl/source/basicide/moduldlg.cxx
@@ -496,6 +496,13 @@ private:
 
         OUString sText(m_rTreeView.get_text(*xSelected));
         OUString sId(m_rTreeView.get_id(*xSelected));
+        /// if copying then clone the userdata
+        if (Entry* pEntry = bMove ? nullptr : 
reinterpret_cast<Entry*>(sId.toUInt64()))
+        {
+            assert(pEntry->GetType() != OBJ_TYPE_DOCUMENT);
+            std::unique_ptr<Entry> 
xNewUserData(std::make_unique<Entry>(*pEntry));
+            sId = 
OUString::number(reinterpret_cast<sal_uInt64>(xNewUserData.release()));
+        }
         std::unique_ptr<weld::TreeIter> xRet(m_rTreeView.make_iterator());
         m_rTreeView.get_widget().insert(xNewParent.get(), nNewChildPos, 
&sText, &sId, nullptr, nullptr, false, xRet.get());
         if (eType == OBJ_TYPE_MODULE)
commit 9c43e6bbbc8cdc606f46636804fb3ceb30871a6d
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri May 13 13:19:47 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    Related: tdf#148197 gtk_tree_view_scroll_to_cell needs either path or column
    
    so a null path is invalid here
    
    Change-Id: I1958e9695e3290e0c513bce89c9548908860754f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134187
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/vcl/unx/gtk3/gtkinst.cxx b/vcl/unx/gtk3/gtkinst.cxx
index 9c6327d7c4f7..e29a1bfb77f3 100644
--- a/vcl/unx/gtk3/gtkinst.cxx
+++ b/vcl/unx/gtk3/gtkinst.cxx
@@ -14552,8 +14552,14 @@ public:
     virtual void set_cursor(int pos) override
     {
         disable_notify_events();
-        GtkTreePath* path = pos != -1 ? gtk_tree_path_new_from_indices(pos, 
-1) : nullptr;
-        gtk_tree_view_scroll_to_cell(m_pTreeView, path, nullptr, false, 0, 0);
+        GtkTreePath* path;
+        if (pos != -1)
+        {
+            path = gtk_tree_path_new_from_indices(pos, -1);
+            gtk_tree_view_scroll_to_cell(m_pTreeView, path, nullptr, false, 0, 
0);
+        }
+        else
+            path = gtk_tree_path_new();
         gtk_tree_view_set_cursor(m_pTreeView, path, nullptr, false);
         gtk_tree_path_free(path);
         enable_notify_events();
commit 2a7255e677202d3e45b2f43a41535a400d366417
Author:     Michael Stahl <[email protected]>
AuthorDate: Tue May 17 14:09:08 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    tdf#148461 sw_redlinehide: fix assert in SwContentNode::DelFrames()
    
    The assert(pMerged->pFirstNode->GetIndex() <= i) is intended for when
    frames are really deleted, but CheckParaRedlineMerge() calls it while
    the now-outdated MergedPara is still on the frame, but the nodes already
    have new flags; assign a dummy node in this situation.
    
    Change-Id: I23fbfdb6901e6e15abf92913aa252e59877bc280
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134475
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 6ee57b39ba912f0902714d8c4d1a267511a3c6ca)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134446
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sw/source/core/docnode/node.cxx b/sw/source/core/docnode/node.cxx
index c9b4a41f42fe..12be064f370b 100644
--- a/sw/source/core/docnode/node.cxx
+++ b/sw/source/core/docnode/node.cxx
@@ -1450,6 +1450,12 @@ void SwContentNode::DelFrames(SwRootFrame const*const 
pLayout)
                                 pMerged->pParaPropsNode = pNode->GetTextNode();
                                 break;
                             }
+                            else if (pMerged->pFirstNode->GetIndex() == i)
+                            {   // this can only happen when called from 
CheckParaRedlineMerge()
+                                // and the pMerged will be deleted anyway
+                                pMerged->pParaPropsNode = pMerged->pFirstNode;
+                                break;
+                            }
                         }
                         
assert(pMerged->listener.IsListeningTo(pMerged->pParaPropsNode));
                     }
commit 489049609b4c8a74e3ea9a570972288a4ff28d7b
Author:     Michael Weghorn <[email protected]>
AuthorDate: Mon May 16 17:24:28 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    tdf#137639 qt: UTF-16-encode mime data for "text/plain;charset=utf-16"
    
    Return a `QVariant` from a `QByteArray` containing the UTF-16-encoded
    characters when mime data for mime type "text/plain;charset=utf-16"
    is requested in `QtMimeData::retrieveData`, rather than
    a `QVariant` created from a a `QString`, to ensure that UTF-16
    encoded data is actually used in the end.
    
    While `QString` uses UTF-16 encoding itself,
    `QMimeDataPrivate::retrieveTypedData` from the Qt library
    would convert the retrieved `QString` data to UTF-8 [1],
    resulting in a mismatch because UTF-8 encoded data would
    actually be returned when UTF-16-encoded one has
    been requested.
    
    This gets called as follows:
    
        0 QtMimeData::retrieveData
        1 QMimeDataPrivate::retrieveTypedData
        2 QMimeData::data
        3 QtMimeData::deepCopy
    
    [1] 
https://code.qt.io/cgit/qt/qtbase.git/tree/src/corelib/kernel/qmimedata.cpp?h=6.3.0#n212
    
    Change-Id: I3db1476838336682584145fb43d397c8eed29ce2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134456
    Tested-by: Jenkins
    Reviewed-by: Michael Weghorn <[email protected]>
    (cherry picked from commit 6fc3ec85a32cd70216b4bbf21e479b4fc32a38dc)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134451
    Tested-by: Ilmari Lauhakangas <[email protected]>
    Reviewed-by: Ilmari Lauhakangas <[email protected]>

diff --git a/vcl/qt5/QtTransferable.cxx b/vcl/qt5/QtTransferable.cxx
index 1ab07dbb6224..24073c9fd792 100644
--- a/vcl/qt5/QtTransferable.cxx
+++ b/vcl/qt5/QtTransferable.cxx
@@ -339,6 +339,11 @@ QVariant QtMimeData::retrieveData(const QString& mimeType, 
QMetaType) const
             aByteArray = QByteArray(reinterpret_cast<const 
char*>(aLocaleString.getStr()),
                                     aLocaleString.getLength());
         }
+        else if (bWantUTF16)
+        {
+            aByteArray = QByteArray(reinterpret_cast<const 
char*>(aString.getStr()),
+                                    aString.getLength() * 2);
+        }
         else
             return QVariant(toQString(aString));
     }
commit 7b2e99a08a5fad314d32cb5f2bc95233edc261a8
Author:     Caolán McNamara <[email protected]>
AuthorDate: Mon May 16 20:50:37 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:16 2022 +0200

    Resolves: tdf#149093 connect_value_change if we will query its value
    
    and not the text_change which is called before the value is parsed
    from the new text
    
    Change-Id: Ib6bd5647139f1b79f299beb42b704b465ddf535c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134368
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sd/source/ui/dlg/BulletAndPositionDlg.cxx 
b/sd/source/ui/dlg/BulletAndPositionDlg.cxx
index 8b42d63c8add..7dc92ee85088 100644
--- a/sd/source/ui/dlg/BulletAndPositionDlg.cxx
+++ b/sd/source/ui/dlg/BulletAndPositionDlg.cxx
@@ -138,7 +138,7 @@ 
SvxBulletAndPositionDlg::SvxBulletAndPositionDlg(weld::Window* pWindow, const Sf
     m_xWidthMF->connect_value_changed(LINK(this, SvxBulletAndPositionDlg, 
SizeHdl_Impl));
     m_xHeightMF->connect_value_changed(LINK(this, SvxBulletAndPositionDlg, 
SizeHdl_Impl));
     m_xRatioCB->connect_toggled(LINK(this, SvxBulletAndPositionDlg, 
RatioHdl_Impl));
-    m_xStartED->connect_changed(LINK(this, SvxBulletAndPositionDlg, 
EditModifyHdl_Impl));
+    m_xStartED->connect_value_changed(LINK(this, SvxBulletAndPositionDlg, 
SpinModifyHdl_Impl));
     m_xPrefixED->connect_changed(LINK(this, SvxBulletAndPositionDlg, 
EditModifyHdl_Impl));
     m_xSuffixED->connect_changed(LINK(this, SvxBulletAndPositionDlg, 
EditModifyHdl_Impl));
     m_xBulRelSizeMF->connect_value_changed(LINK(this, SvxBulletAndPositionDlg, 
BulRelSizeHdl_Impl));
@@ -662,7 +662,7 @@ void 
SvxBulletAndPositionDlg::CheckForStartValue_Impl(sal_uInt16 nNumberingType)
                           || SVX_NUM_CHARS_LOWER_LETTER_N == nNumberingType;
     m_xStartED->set_min(bNoZeroAllowed ? 1 : 0);
     if (bIsNull && bNoZeroAllowed)
-        EditModifyHdl_Impl(*m_xStartED);
+        SpinModifyHdl_Impl(*m_xStartED);
 }
 
 IMPL_LINK(SvxBulletAndPositionDlg, LevelHdl_Impl, weld::TreeView&, rBox, void)
@@ -1128,6 +1128,11 @@ IMPL_LINK(SvxBulletAndPositionDlg, EditModifyHdl_Impl, 
weld::Entry&, rEdit, void
     EditModifyHdl_Impl(&rEdit);
 }
 
+IMPL_LINK(SvxBulletAndPositionDlg, SpinModifyHdl_Impl, weld::SpinButton&, 
rSpinButton, void)
+{
+    EditModifyHdl_Impl(&rSpinButton);
+}
+
 IMPL_LINK(SvxBulletAndPositionDlg, DistanceHdl_Impl, weld::MetricSpinButton&, 
rFld, void)
 {
     if (bInInitControl)
diff --git a/sd/source/ui/inc/BulletAndPositionDlg.hxx 
b/sd/source/ui/inc/BulletAndPositionDlg.hxx
index b6984af8ccb5..2d03db6fa916 100644
--- a/sd/source/ui/inc/BulletAndPositionDlg.hxx
+++ b/sd/source/ui/inc/BulletAndPositionDlg.hxx
@@ -124,6 +124,7 @@ class SvxBulletAndPositionDlg : public 
weld::GenericDialogController
     DECL_LINK(SizeHdl_Impl, weld::MetricSpinButton&, void);
     DECL_LINK(RatioHdl_Impl, weld::Toggleable&, void);
     DECL_LINK(EditModifyHdl_Impl, weld::Entry&, void);
+    DECL_LINK(SpinModifyHdl_Impl, weld::SpinButton&, void);
     DECL_LINK(BulColorHdl_Impl, ColorListBox&, void);
     DECL_LINK(BulRelSizeHdl_Impl, weld::MetricSpinButton&, void);
     DECL_LINK(PreviewInvalidateHdl_Impl, Timer*, void);
commit f8d171acf0ed84d011ac4579fa4fb8c1d48af215
Author:     Michael Stahl <[email protected]>
AuthorDate: Tue May 17 16:08:39 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    tdf#147220 sw_redlinehide: update frames in ReplaceRangeImpl()
    
    Change-Id: Ie5d62eaec01a3b06ff1bd6070510384641ea7ad3
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134483
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 1f8795df957c18c5c06bf1d68d0d60b1d30f015d)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134448
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx 
b/sw/qa/extras/uiwriter/uiwriter.cxx
index d38c33364803..b7593759971b 100644
--- a/sw/qa/extras/uiwriter/uiwriter.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter.cxx
@@ -138,6 +138,7 @@
 #include <unotxdoc.hxx>
 #include <comphelper/processfactory.hxx>
 #include <rootfrm.hxx>
+#include <txtfrm.hxx>
 
 namespace
 {
@@ -693,6 +694,43 @@ void SwUiWriterTest::testTdf67238()
     
CPPUNIT_ASSERT(!((rTable.GetTableBox("C3"))->GetFrameFormat()->GetProtect()).IsContentProtected());
 }
 
+CPPUNIT_TEST_FIXTURE(SwUiWriterTest, testTdf147220)
+{
+    SwDoc* pDoc = createSwDoc();
+    SwWrtShell* pWrtShell = pDoc->GetDocShell()->GetWrtShell();
+
+    pWrtShell->Insert(u"él");
+
+    // hide and enable
+    dispatchCommand(mxComponent, ".uno:ShowTrackedChanges", {});
+    dispatchCommand(mxComponent, ".uno:TrackChanges", {});
+    CPPUNIT_ASSERT(pDoc->getIDocumentRedlineAccess().IsRedlineOn());
+    CPPUNIT_ASSERT(
+        
IDocumentRedlineAccess::IsShowChanges(pDoc->getIDocumentRedlineAccess().GetRedlineFlags()));
+    CPPUNIT_ASSERT(pWrtShell->GetLayout()->IsHideRedlines());
+
+    pWrtShell->GoStartSentence();
+    pWrtShell->SetMark();
+    pWrtShell->GoEndSentence();
+
+    // this did not remove the original text from the layout
+    pWrtShell->Replace(u"Él", false);
+
+    // currently the deleted text is before the replacement text, not sure if
+    // that is really required
+    CPPUNIT_ASSERT_EQUAL(OUString(u"élÉl"),
+        
pWrtShell->GetCursor()->GetPoint()->nNode.GetNode().GetTextNode()->GetText());
+    CPPUNIT_ASSERT_EQUAL(OUString(u"Él"),
+        static_cast<SwTextFrame 
const*>(pWrtShell->GetCursor()->GetPoint()->nNode.GetNode().GetTextNode()->getLayoutFrame(nullptr))->GetText());
+
+    SwRedlineTable const& 
rRedlines(pDoc->getIDocumentRedlineAccess().GetRedlineTable());
+    CPPUNIT_ASSERT_EQUAL(SwRedlineTable::size_type(2), rRedlines.size());
+    CPPUNIT_ASSERT_EQUAL(RedlineType::Delete, rRedlines[0]->GetType());
+    CPPUNIT_ASSERT_EQUAL(OUString(u"él"), rRedlines[0]->GetText());
+    CPPUNIT_ASSERT_EQUAL(RedlineType::Insert, rRedlines[1]->GetType());
+    CPPUNIT_ASSERT_EQUAL(OUString(u"Él"), rRedlines[1]->GetText());
+}
+
 CPPUNIT_TEST_FIXTURE(SwUiWriterTest, testTdf135978)
 {
     SwDoc* pDoc = createSwDoc();
diff --git a/sw/source/core/doc/DocumentContentOperationsManager.cxx 
b/sw/source/core/doc/DocumentContentOperationsManager.cxx
index 286381f56158..69f9899d14e9 100644
--- a/sw/source/core/doc/DocumentContentOperationsManager.cxx
+++ b/sw/source/core/doc/DocumentContentOperationsManager.cxx
@@ -4607,7 +4607,12 @@ bool DocumentContentOperationsManager::ReplaceRangeImpl( 
SwPaM& rPam, const OUSt
                 m_rDoc.GetIDocumentUndoRedo().AppendUndo(
                     std::make_unique<SwUndoRedlineDelete>( aDelPam, 
SwUndoId::REPLACE ));
             }
+            // add redline similar to DeleteAndJoinWithRedlineImpl()
+            std::shared_ptr<SwUnoCursor> const 
pCursor(m_rDoc.CreateUnoCursor(*aDelPam.GetMark()));
+            pCursor->SetMark();
+            *pCursor->GetPoint() = *aDelPam.GetPoint();
             m_rDoc.getIDocumentRedlineAccess().AppendRedline( new 
SwRangeRedline( RedlineType::Delete, aDelPam ), true);
+            sw::UpdateFramesForAddDeleteRedline(m_rDoc, *pCursor);
 
             *rPam.GetMark() = *aDelPam.GetMark();
             if (m_rDoc.GetIDocumentUndoRedo().DoesUndo())
commit fb1c3677fe929c824be42c1c60cf96f355152a89
Author:     Michael Stahl <[email protected]>
AuthorDate: Tue May 17 13:12:49 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    tdf#148869 sw_redlinehide: fix SwView::ExecSpellPopup()
    
    How could i forget that MovePara(GoCurrPara, fnParaStart) will move to
    a previous paragraph when it's already at the start of the current one,
    it's so intuitive.
    
    (regression from commit d814941b31b4f9cc8b6e9bd4ddc5188015529707)
    
    Change-Id: Ief9bcd42b7ea78feef50ac42bc93580c29c080b2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134468
    Tested-by: Michael Stahl <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit e2ff01a08a70a96517287ac9b9e9de6fbfd6a00b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134445
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/source/uibase/uiview/viewling.cxx 
b/sw/source/uibase/uiview/viewling.cxx
index ad7e9e697d04..461f7c8afa58 100644
--- a/sw/source/uibase/uiview/viewling.cxx
+++ b/sw/source/uibase/uiview/viewling.cxx
@@ -694,9 +694,15 @@ bool SwView::ExecSpellPopup(const Point& rPt)
                 if (pNode)
                 {
                     pCursorShell->Push();
-                    pCursorShell->MovePara(GoCurrPara, fnParaStart);
+                    if (!pCursorShell->IsSttPara())
+                    {
+                        pCursorShell->MovePara(GoCurrPara, fnParaStart);
+                    }
                     pCursorShell->SetMark();
-                    pCursorShell->MovePara(GoCurrPara, fnParaEnd);
+                    if (!pCursorShell->IsEndPara())
+                    {
+                        pCursorShell->MovePara(GoCurrPara, fnParaEnd);
+                    }
                     aParaText = pCursorShell->GetSelText();
                     pCursorShell->Pop(SwCursorShell::PopMode::DeleteCurrent);
                 }
commit 138ec813068e9f62e255ee3b8f7d340feba50067
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Sep 10 19:51:41 2021 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    sw: fix assert in SwObjectFormatterTextFrame
    
    sw/source/core/layout/objectformattertxtfrm.cxx:237: virtual bool 
SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool): Assertion 
`GetPageFrame().GetPhyPageNum() == GetPgNumOfCollected(nIdx)' failed.
    
    The problem is that there are multiple (9) flys on text frame 324.
    
    In the loop in CalcContent(), frame 324 starts out on page 13, then
    with the first/second fly moves to page 12, then with the 3rd fly moves
    forward to page 13 - but the pPageFrame that is passed to
    SwObjectFormatter::FormatObj() was fetched outside of the loop.
    
    (regression from commit c799de145f7e289f31e3669646e5bd12814e6c5e
     and commit 533a998e540b0f04068c876dde0e74adc3f79c93)
    
    Change-Id: Iae573900b4b6558634bfed161e5c95bd5ba27151
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121924
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 7d20dc2ca69711c61fb1593ad85ccdef282c978d)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134447
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sw/qa/extras/layout/data/tdf123163-1.docx 
b/sw/qa/extras/layout/data/tdf123163-1.docx
new file mode 100644
index 000000000000..3f8865cb49b1
Binary files /dev/null and b/sw/qa/extras/layout/data/tdf123163-1.docx differ
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index 61423e3791f7..08e33c87980c 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -3064,6 +3064,12 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf116501)
     createSwDoc(DATA_DIRECTORY, "tdf116501.odt");
 }
 
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf123163)
+{
+    //just care it doesn't assert
+    createSwDoc(DATA_DIRECTORY, "tdf123163-1.docx");
+}
+
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testAbi11870)
 {
     //just care it doesn't assert
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index 1a0a93e5fc01..e54f88c274a2 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -1528,11 +1528,13 @@ void CalcContent( SwLayoutFrame *pLay, bool bNoColl )
             {
                 bool bAgain = false;
                 bool bRestartLayoutProcess = false;
-                SwPageFrame* pPageFrame = pFrame->FindPageFrame();
                 size_t nCnt = pFrame->GetDrawObjs()->size();
                 size_t i = 0;
                 while ( i < nCnt )
                 {
+                    // pFrame can move to a different page in FormatObj()
+                    SwPageFrame *const pPageFrame = pFrame->FindPageFrame();
+
                     // #i28701#
                     SwAnchoredObject* pAnchoredObj = 
(*pFrame->GetDrawObjs())[i];
                     assert(pAnchoredObj);
commit 68eec63db9c9b4940fe963408144b075cd9674a5
Author:     Michael Stahl <[email protected]>
AuthorDate: Wed May 11 18:10:33 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    framework: fix lock assert in Job::execute()
    
    include/osl/mutex.hxx:196: void osl::ClearableGuard<T>::clear() [with T = 
comphelper::SolarMutex]: Assertion `pT' failed.
    
    because clear() was called, then an exception was thrown and reset() was
    omitted.
    
    Change-Id: Iaa6d26e23261c2426eb3cc465b212752c4f454e5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134195
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit ebbf4004d6061c3b31f9749bee06ef87afc5deb9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134179
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/framework/source/jobs/job.cxx b/framework/source/jobs/job.cxx
index 39b867ac3291..d2d9403e4ab2 100644
--- a/framework/source/jobs/job.cxx
+++ b/framework/source/jobs/job.cxx
@@ -156,6 +156,18 @@ void Job::setJobData( const JobData& aData )
 void Job::execute( /*IN*/ const css::uno::Sequence< css::beans::NamedValue >& 
lDynamicArgs )
 {
     /* SAFE { */
+    class SolarMutexAntiGuard {
+        SolarMutexResettableGuard & m_rGuard;
+    public:
+        SolarMutexAntiGuard(SolarMutexResettableGuard & rGuard) : 
m_rGuard(rGuard)
+        {
+            m_rGuard.clear();
+        }
+        ~SolarMutexAntiGuard()
+        {
+            m_rGuard.reset();
+        }
+    };
     SolarMutexResettableGuard aWriteLock;
 
     // reject dangerous calls
@@ -191,23 +203,24 @@ void Job::execute( /*IN*/ const css::uno::Sequence< 
css::beans::NamedValue >& lD
         if (xAJob.is())
         {
             m_aAsyncWait.reset();
-            aWriteLock.clear();
+            SolarMutexAntiGuard const ag(aWriteLock);
             /* } SAFE */
             xAJob->executeAsync(lJobArgs, xThis);
             // wait for finishing this job - so this method
             // does the same for synchronous and asynchronous jobs!
             m_aAsyncWait.wait();
-            aWriteLock.reset();
             /* SAFE { */
             // Note: Result handling was already done inside the callback!
         }
         // execute it synchron
         else if (xSJob.is())
         {
-            aWriteLock.clear();
-            /* } SAFE */
-            css::uno::Any aResult = xSJob->execute(lJobArgs);
-            aWriteLock.reset();
+            css::uno::Any aResult;
+            {
+                SolarMutexAntiGuard const ag(aWriteLock);
+                /* } SAFE */
+                aResult = xSJob->execute(lJobArgs);
+            }
             /* SAFE { */
             impl_reactForJobResult(aResult);
         }
commit 16ad0a66321530b185138af3a5b01b38c572e396
Author:     Michael Stahl <[email protected]>
AuthorDate: Thu Aug 12 13:04:54 2021 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    tdf#147250 configure: default to --with-system-nss on Linux
    
    NSS is very ABI compatible and part of current LSB 5.0 and so it should
    just work to use the one from the system, i'm not aware of a Linux that
    doesn't ship it.
    
    There used to be some feature patch in external/nss but this was removed
    years ago, now it just contains build fixes.
    
    Problems can occur if a mixture of system and bundled NSS libraries is
    loaded, if first an old version .so is loaded and then newer version .so
    depends on it but can't find some required symbol.
    
    See for example:
    
https://www.mail-archive.com/[email protected]/msg287043.html
    
    Another issue is that e.g. Fedora ships libnsspem.so in the nss-pem
    package, which may cause trouble in ASAN builds, where the internal NSS
    is built to call __asan_poison_memory_region but the system
    libnss-pem.so doesn't call __asan_unpoison_memory_region so we get:
    
      ==2568944==ERROR: AddressSanitizer: use-after-poison on address 
0x61d0019afab0
      WRITE of size 192 at 0x61d0019afab0 thread T28 (utl::Moderator)
        0 in __interceptor_memset.part.0 (instdir/program/soffice.bin+0x466460)
        1  (/lib64/libnsspem.so+0x15f3d)
        2  (/lib64/libnsspem.so+0x16185)
        3  (/lib64/libnsspem.so+0x8a9b)
        4  (/lib64/libnsspem.so+0xe13b)
        5 in secmod_ModuleInit 
workdir/UnpackedTarball/nss/nss/lib/pk11wrap/pk11load.c:244:11
        ..
        21 in curl_easy_perform workdir/UnpackedTarball/curl/lib/easy.c:715:10
    
    Also, with system NSS, things like p11-kit integration become
    responsibility of the OS.
    
    Change-Id: I50caedd46914dd5d6905c5d32d44a599cd78119e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120388
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 0028266e34a683b1650410cee65dac502e304c9f)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134293
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/bin/check-elf-dynamic-objects b/bin/check-elf-dynamic-objects
index 523a892e4259..712856d1104c 100755
--- a/bin/check-elf-dynamic-objects
+++ b/bin/check-elf-dynamic-objects
@@ -88,7 +88,7 @@ programfiles=$(echo ${files} | grep -o '/program/[^/]* ' | 
xargs -n 1 basename)
 # of maintaining ABI stability
 # allow extending the allowlist using the environment variable to be able to 
work
 # on the installer stuff without the need for a baseline setup
-globalallowlist="ld-linux-x86-64.so.2 ld-linux.so.2 libc.so.6 libm.so.6 
libdl.so.2 libpthread.so.0 librt.so.1 libutil.so.1 libnsl.so.1 libcrypt.so.1 
libgcc_s.so.1 libstdc++.so.6 libz.so.1 libfontconfig.so.1 libfreetype.so.6 
libxml2.so.2 libxslt.so.1 libexslt.so.0 ${LO_ELFCHECK_ALLOWLIST-}"
+globalallowlist="ld-linux-x86-64.so.2 ld-linux.so.2 libc.so.6 libm.so.6 
libdl.so.2 libpthread.so.0 librt.so.1 libutil.so.1 libnsl.so.1 libcrypt.so.1 
libgcc_s.so.1 libstdc++.so.6 libz.so.1 libfontconfig.so.1 libfreetype.so.6 
libxml2.so.2 libxslt.so.1 libexslt.so.0 libnspr4.so libnss3.so libnssutil3.so 
libplc4.so libplds4.so libsmime3.so libssl3.so ${LO_ELFCHECK_ALLOWLIST-}"
 x11allowlist="libX11.so.6 libX11-xcb.so.1 libXext.so.6 libSM.so.6 libICE.so.6 
libXinerama.so.1 libXrender.so.1 libXrandr.so.2 libcairo.so.2"
 openglallowlist="libGL.so.1"
 gobjectallowlist="libgobject-2.0.so.0 libglib-2.0.so.0"
diff --git a/configure.ac b/configure.ac
index e03d7fc1c80b..19b227786bcb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10507,7 +10507,15 @@ dnl 
===================================================================
 dnl Check for system NSS
 dnl ===================================================================
 if test "$enable_fuzzers" != "yes" -a "$enable_nss" = "yes"; then
-    libo_CHECK_SYSTEM_MODULE([nss],[NSS],[nss >= 3.9.3 nspr >= 4.8])
+    libo_CHECK_SYSTEM_MODULE([nss],[NSS],[nss >= 3.9.3 nspr >= 4.8],,,[
+        case "$_os" in
+            Linux)
+                with_system_nss=yes
+            ;;
+            *)
+                with_system_nss=no
+            ;;
+        esac])
     AC_DEFINE(HAVE_FEATURE_NSS)
     ENABLE_NSS=TRUE
 elif test $_os != iOS ; then
diff --git a/m4/libo_externals.m4 b/m4/libo_externals.m4
index f755358bb395..659b539dc539 100644
--- a/m4/libo_externals.m4
+++ b/m4/libo_externals.m4
@@ -10,7 +10,7 @@ AC_DEFUN([libo_CHECK_SYSTEM_MODULE], [
 AC_ARG_WITH(system-$1,
     AS_HELP_STRING([--with-system-$1],
         [Use $1 from operating system instead of building and bundling it.]),,
-    [with_system_$1="$with_system_libs"])
+    ifelse([$6],,[with_system_$1="$with_system_libs"],[[$6]]))
 AC_MSG_CHECKING([which $1 to use])
 if test "$with_system_$1" = "yes"; then
     AC_MSG_RESULT([external])
commit a8a32dde08753e03af53e21e4cf5d1e7a3fcc869
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu May 12 16:37:19 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    tdf#148706: map value prop in numericfield to text
    
    Change-Id: Ifc37b0aa8dc657d7a7f05199c8132896d03eb437
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134240
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 3bd7111fe29ce19a007915af87f1f9269d27d9ff)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134183
    Reviewed-by: Michael Weghorn <[email protected]>

diff --git a/toolkit/source/helper/formpdfexport.cxx 
b/toolkit/source/helper/formpdfexport.cxx
index aa5224e377f2..7e762a9ff152 100644
--- a/toolkit/source/helper/formpdfexport.cxx
+++ b/toolkit/source/helper/formpdfexport.cxx
@@ -314,10 +314,18 @@ namespace toolkitform
             Any aText;
             static constexpr OUStringLiteral FM_PROP_TEXT = u"Text";
             static constexpr OUStringLiteral FM_PROP_LABEL = u"Label";
+            static constexpr OUStringLiteral FM_PROP_VALUE = u"Value";
             if ( xPSI->hasPropertyByName( FM_PROP_TEXT ) )
                 aText = xModelProps->getPropertyValue( FM_PROP_TEXT );
             else if ( xPSI->hasPropertyByName( FM_PROP_LABEL ) )
                 aText = xModelProps->getPropertyValue( FM_PROP_LABEL );
+            else if ( xPSI->hasPropertyByName( FM_PROP_VALUE ) )
+            {
+                double aValue;
+                if (xModelProps->getPropertyValue( FM_PROP_VALUE ) >>= aValue)
+                    aText <<= OUString::number(aValue);
+            }
+
             if ( aText.hasValue() ) {
                 if( ! (aText >>= Descriptor->Text) ) {
                     SAL_WARN("toolkit.helper", "describePDFControl: unable to 
assign aText to Descriptor->Text");
diff --git a/vcl/qa/cppunit/pdfexport/data/tdf148706.odt 
b/vcl/qa/cppunit/pdfexport/data/tdf148706.odt
new file mode 100644
index 000000000000..974bb97433f0
Binary files /dev/null and b/vcl/qa/cppunit/pdfexport/data/tdf148706.odt differ
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx 
b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 95c6325c5a26..24c482b5389c 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -608,6 +608,41 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf107018)
     CPPUNIT_ASSERT_EQUAL(OString("Pages"), pName->GetValue());
 }
 
+CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148706)
+{
+    // Import the bugdoc and export as PDF.
+    aMediaDescriptor["FilterName"] <<= OUString("writer_pdf_Export");
+    saveAsPDF(u"tdf148706.odt");
+
+    // Parse the export result with pdfium.
+    std::unique_ptr<vcl::pdf::PDFiumDocument> pPdfDocument = parseExport();
+    CPPUNIT_ASSERT(pPdfDocument);
+
+    // The document has one page.
+    CPPUNIT_ASSERT_EQUAL(1, pPdfDocument->getPageCount());
+    std::unique_ptr<vcl::pdf::PDFiumPage> pPdfPage = 
pPdfDocument->openPage(/*nIndex=*/0);
+    CPPUNIT_ASSERT(pPdfPage);
+
+    // The page has one annotation.
+    CPPUNIT_ASSERT_EQUAL(1, pPdfPage->getAnnotationCount());
+    std::unique_ptr<vcl::pdf::PDFiumAnnotation> pAnnot = 
pPdfPage->getAnnotation(0);
+
+    CPPUNIT_ASSERT(pAnnot->hasKey("V"));
+    CPPUNIT_ASSERT_EQUAL(vcl::pdf::PDFObjectType::String, 
pAnnot->getValueType("V"));
+    OUString aV = pAnnot->getString("V");
+
+    // Without the fix in place, this test would have failed with
+    // - Expected: 1821.84
+    // - Actual  :
+    CPPUNIT_ASSERT_EQUAL(OUString("1821.84"), aV);
+
+    CPPUNIT_ASSERT(pAnnot->hasKey("DV"));
+    CPPUNIT_ASSERT_EQUAL(vcl::pdf::PDFObjectType::String, 
pAnnot->getValueType("DV"));
+    OUString aDV = pAnnot->getString("DV");
+
+    CPPUNIT_ASSERT_EQUAL(OUString("1821.84"), aDV);
+}
+
 CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf107089)
 {
     vcl::filter::PDFDocument aDocument;
commit 2573a11f0b240ae7852a8e10f2aef98845979c43
Author:     Caolán McNamara <[email protected]>
AuthorDate: Mon May 16 10:23:02 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    Related: tdf#137748 "Update" should have use-underline
    
    Change-Id: I8303cd8d2cabd8888797758870480483661d8801
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134364
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <[email protected]>
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sw/uiconfig/swriter/ui/statisticsinfopage.ui 
b/sw/uiconfig/swriter/ui/statisticsinfopage.ui
index 22cf3cfd4cfb..adceafe78648 100644
--- a/sw/uiconfig/swriter/ui/statisticsinfopage.ui
+++ b/sw/uiconfig/swriter/ui/statisticsinfopage.ui
@@ -242,6 +242,7 @@
         <property name="can_focus">True</property>
         <property name="receives_default">True</property>
         <property name="halign">start</property>
+        <property name="use-underline">True</property>
       </object>
       <packing>
         <property name="left_attach">1</property>
commit b3595a3877e27df0c269da63b17d641e6422e6b4
Author:     Justin Luth <[email protected]>
AuthorDate: Fri May 13 06:18:23 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:15 2022 +0200

    tdf#124820 sc: overwrite more character level font attributes
    
    The issue here is that certain character properties applied
    at the cell level did not clear out those properties from
    the character runs. Specifically strikethrough, underline,
    overline, italics, outline, shadow.
    
    Specifically for xlsx import - where a default value is
    specified in many cases instead of not being defined
    at all - this meant that the cell change had no real
    effect, since the direct properties have priority.
    
    A 2010 commit 4ef978de83610b0e1912bce1d59432b9c382b9fc
    did this for font, size, bold, and color.
    Perhaps that was all that was needed at that time,
    although even back these other properties probably
    should have been handled as well, because the cell-change
    didn't affect the entire contents.
    
    In 2013 a LO 4.1 commit f54ce3e7f6d6aab7e34c54ad8eff06650e076fef
    increased the impact during xlsx import.
    
    I assume that adding the CTL/CJK attributes is also necessary.
    
    Change-Id: Id933af1ce187a79851868a6a295b33758062fe3b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134254
    Tested-by: Jenkins
    Reviewed-by: Justin Luth <[email protected]>
    Reviewed-by: Kohei Yoshida <[email protected]>
    (cherry picked from commit f413eb0b43fa36edf69909f3821dfe6a54e3edf7)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134363
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sc/source/core/tool/editutil.cxx b/sc/source/core/tool/editutil.cxx
index be0906929c41..c7e0c0cb6830 100644
--- a/sc/source/core/tool/editutil.cxx
+++ b/sc/source/core/tool/editutil.cxx
@@ -159,9 +159,22 @@ void ScEditUtil::RemoveCharAttribs( EditTextObject& 
rEditText, const ScPatternAt
         sal_uInt16 nCharType;
     } AttrTypeMap[] = {
         { ATTR_FONT,        EE_CHAR_FONTINFO },
+        { ATTR_CJK_FONT, EE_CHAR_FONTINFO_CJK },
+        { ATTR_CTL_FONT, EE_CHAR_FONTINFO_CTL },
         { ATTR_FONT_HEIGHT, EE_CHAR_FONTHEIGHT },
+        { ATTR_CJK_FONT_HEIGHT, EE_CHAR_FONTHEIGHT_CJK },
+        { ATTR_CTL_FONT_HEIGHT, EE_CHAR_FONTHEIGHT_CTL },
         { ATTR_FONT_WEIGHT, EE_CHAR_WEIGHT },
-        { ATTR_FONT_COLOR,  EE_CHAR_COLOR }
+        { ATTR_CJK_FONT_WEIGHT, EE_CHAR_WEIGHT_CJK },
+        { ATTR_CTL_FONT_WEIGHT, EE_CHAR_WEIGHT_CTL },
+        { ATTR_FONT_POSTURE, EE_CHAR_ITALIC },
+        { ATTR_CJK_FONT_POSTURE, EE_CHAR_ITALIC_CJK },
+        { ATTR_CTL_FONT_POSTURE, EE_CHAR_ITALIC_CTL },
+        { ATTR_FONT_COLOR, EE_CHAR_COLOR },
+        { ATTR_FONT_UNDERLINE, EE_CHAR_UNDERLINE },
+        { ATTR_FONT_CROSSEDOUT, EE_CHAR_STRIKEOUT },
+        { ATTR_FONT_CONTOUR, EE_CHAR_OUTLINE },
+        { ATTR_FONT_SHADOWED, EE_CHAR_SHADOW }
     };
 
     const SfxItemSet& rSet = rAttr.GetItemSet();
commit d8a5bea5571921b6e9b0bfe2b31b11afe2633528
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Apr 1 15:08:09 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    forcepoint#97 avoid Invalid read of size 2
    
     ==143282== Invalid read of size 2
     ==143282==    at 0x190CDBFC: SfxItemSet::Count() const (itemset.hxx:96)
     ==143282==    by 0x1910F33E: SfxItemSet::Get(unsigned short, bool) const 
(itemset.cxx:748)
     ==143282==    by 0x1F14D76C: ScPatternAttr::GetItem(unsigned short, 
SfxItemSet const&, SfxItemSet const*) (patattr.cxx:1347)
     ==143282==    by 0x1F14D7DA: ScPatternAttr::GetItem(unsigned short, 
SfxItemSet const*) const (patattr.cxx:1352)
     ==143282==    by 0x202A3E44: ScLineBreakCell const& 
ScPatternAttr::GetItem<ScLineBreakCell>(TypedWhichId<ScLineBreakCell>, 
SfxItemSet const*) const (patattr.hxx:83)
     ==143282==    by 0x2028E8BC: ScOutputData::LayoutStrings(bool, bool, 
ScAddress const&) (output2.cxx:1677)
     ==143282==    by 0x2028D4A8: ScOutputData::DrawStrings(bool) 
(output2.cxx:1473)
     ==143282==    by 0x202D9879: ScPrintFunc::PrintArea(short, int, short, 
int, long, long, bool, bool, bool, bool) (printfun.cxx:1675)
     ==143282==    by 0x202DD459: ScPrintFunc::PrintPage(long, short, int, 
short, int, bool, ScPreviewLocationData*) (printfun.cxx:2301)
     ==143282==    by 0x202DF491: ScPrintFunc::DoPrint(MultiSelection const&, 
long, long, bool, ScPreviewLocationData*) (printfun.cxx:2713)
     ==143282==    by 0x20031888: ScModelObj::render(int, 
com::sun::star::uno::Any const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(docuno.cxx:2259)
     ==143282==    by 0x30C1A485: PDFExport::ExportSelection(vcl::PDFWriter&, 
com::sun::star::uno::Reference<com::sun::star::view::XRenderable> const&, 
com::sun::star::uno::Any const&, StringRangeEnumerator const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&, int) 
(pdfexport.cxx:219)
     ==143282==    by 0x30C1F879: PDFExport::Export(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(pdfexport.cxx:987)
     ==143282==    by 0x30C33BA2: 
PDFFilter::implExport(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) (pdffilter.cxx:174)
     ==143282==    by 0x30C33F2A: 
PDFFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) (pdffilter.cxx:237)
     ==143282==    by 0x21AC6986: SfxObjectShell::ExportTo(SfxMedium&) 
(objstor.cxx:2488)
     ==143282==    by 0x21AC2363: SfxObjectShell::SaveTo_Impl(SfxMedium&, 
SfxItemSet const*) (objstor.cxx:1553)
     ==143282==    by 0x21ACE816: 
SfxObjectShell::PreDoSaveAs_Impl(rtl::OUString const&, rtl::OUString const&, 
SfxItemSet const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(objstor.cxx:2966)
     ==143282==    by 0x21ACCA87: 
SfxObjectShell::CommonSaveAs_Impl(INetURLObject const&, rtl::OUString const&, 
SfxItemSet&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(objstor.cxx:2756)
     ==143282==    by 0x21AA8CDB: SfxObjectShell::APISaveAs_Impl(rtl::OUString 
const&, SfxItemSet&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(objserv.cxx:317)
     ==143282==    by 0x21B2B4AD: SfxBaseModel::impl_store(rtl::OUString 
const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> 
const&, bool) (sfxbasemodel.cxx:3132)
     ==143282==    by 0x21B2CB12: SfxBaseModel::storeToURL(rtl::OUString 
const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> 
const&) (sfxbasemodel.cxx:1768)
     ==143282==    by 0x1C507AFE: 
ScPDFExportTest::exportToPDF(com::sun::star::uno::Reference<com::sun::star::frame::XModel>
 const&, ScRange const&) (scpdfexport.cxx:192)
     ==143282==    by 0x1C511A33: ScPDFExportTest::testForcepoint97() 
(scpdfexport.cxx:571)
     ==143282==    by 0x1C52778D: void std::__invoke_impl<void, void 
(ScPDFExportTest::*&)(), ScPDFExportTest*&>(std::__invoke_memfun_deref, void 
(ScPDFExportTest::*&)(), ScPDFExportTest*&) (invoke.h:74)
     ==143282==    by 0x1C5276C1: std::__invoke_result<void 
(ScPDFExportTest::*&)(), ScPDFExportTest*&>::type std::__invoke<void 
(ScPDFExportTest::*&)(), ScPDFExportTest*&>(void (ScPDFExportTest::*&)(), 
ScPDFExportTest*&) (invoke.h:96)
     ==143282==    by 0x1C527659: void std::_Bind<void 
(ScPDFExportTest::*(ScPDFExportTest*))()>::__call<void, , 0ul>(std::tuple<>&&, 
std::_Index_tuple<0ul>) (functional:420)
     ==143282==    by 0x1C5275E2: void std::_Bind<void 
(ScPDFExportTest::*(ScPDFExportTest*))()>::operator()<, void>() (functional:503)
     ==143282==    by 0x1C52758C: void std::__invoke_impl<void, std::_Bind<void 
(ScPDFExportTest::*(ScPDFExportTest*))()>&>(std::__invoke_other, 
std::_Bind<void (ScPDFExportTest::*(ScPDFExportTest*))()>&) (invoke.h:61)
     ==143282==    by 0x1C52753C: std::enable_if<is_invocable_r_v<void, 
std::_Bind<void (ScPDFExportTest::*(ScPDFExportTest*))()>&>, void>::type 
std::__invoke_r<void, std::_Bind<void 
(ScPDFExportTest::*(ScPDFExportTest*))()>&>(std::_Bind<void 
(ScPDFExportTest::*(ScPDFExportTest*))()>&) (invoke.h:111)
     ==143282==    by 0x1C52731C: std::_Function_handler<void (), 
std::_Bind<void (ScPDFExportTest::*(ScPDFExportTest*))()> 
>::_M_invoke(std::_Any_data const&) (std_function.h:290)
     ==143282==    by 0x1C527A34: std::function<void ()>::operator()() const 
(std_function.h:590)
     ==143282==    by 0x1C527078: 
CppUnit::TestCaller<ScPDFExportTest>::runTest() (TestCaller.h:175)
     ==143282==    by 0x49326F2: CppUnit::TestCaseMethodFunctor::operator()() 
const (TestCase.cpp:32)
     ==143282==    by 0x15937E3D: (anonymous 
namespace)::Protector::protect(CppUnit::Functor const&, 
CppUnit::ProtectorContext const&) (vclbootstrapprotector.cxx:46)
     ==143282==    by 0x4929ED1: 
CppUnit::ProtectorChain::ProtectFunctor::operator()() const 
(ProtectorChain.cpp:20)
     ==143282==    by 0x4B05D6D: (anonymous 
namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext 
const&) (unobootstrapprotector.cxx:78)
     ==143282==    by 0x4929ED1: 
CppUnit::ProtectorChain::ProtectFunctor::operator()() const 
(ProtectorChain.cpp:20)
     ==143282==    by 0x4AF2F2A: (anonymous 
namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext 
const&) (unoexceptionprotector.cxx:62)
     ==143282==    by 0x4929ED1: 
CppUnit::ProtectorChain::ProtectFunctor::operator()() const 
(ProtectorChain.cpp:20)
     ==143282==    by 0x491261E: 
CppUnit::DefaultProtector::protect(CppUnit::Functor const&, 
CppUnit::ProtectorContext const&) (DefaultProtector.cpp:15)
     ==143282==    by 0x4929ED1: 
CppUnit::ProtectorChain::ProtectFunctor::operator()() const 
(ProtectorChain.cpp:20)
     ==143282==    by 0x4928690: 
CppUnit::ProtectorChain::protect(CppUnit::Functor const&, 
CppUnit::ProtectorContext const&) (ProtectorChain.cpp:86)
     ==143282==    by 0x4946ACD: CppUnit::TestResult::protect(CppUnit::Functor 
const&, CppUnit::Test*, std::__cxx11::basic_string<char, 
std::char_traits<char>, std::allocator<char> > const&) (TestResult.cpp:182)
     ==143282==    by 0x4932103: CppUnit::TestCase::run(CppUnit::TestResult*) 
(TestCase.cpp:91)
     ==143282==    by 0x4932BCF: 
CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) 
(TestComposite.cpp:64)
     ==143282==    by 0x4932A5F: 
CppUnit::TestComposite::run(CppUnit::TestResult*) (TestComposite.cpp:23)
     ==143282==    by 0x4932BCF: 
CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) 
(TestComposite.cpp:64)
     ==143282==    by 0x4932A5F: 
CppUnit::TestComposite::run(CppUnit::TestResult*) (TestComposite.cpp:23)
     ==143282==    by 0x494FDBF: 
CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) 
(TestRunner.cpp:47)
     ==143282==  Address 0x1d7624b0 is 64 bytes inside a block of size 120 
free'd
     ==143282==    at 0x4847669: operator delete(void*) 
(vg_replace_malloc.c:923)
     ==143282==    by 0x1F150EA1: ScPatternAttr::~ScPatternAttr() 
(patattr.hxx:53)
     ==143282==    by 0x190D29B2: SfxItemPool::Remove(SfxPoolItem const&) 
(itempool.cxx:802)
     ==143282==    by 0x1EA27F8E: ScAttrArray::SetPatternAreaImpl(int, int, 
ScPatternAttr const*, bool, ScEditDataArray*, bool) (attarray.cxx:574)
     ==143282==    by 0x1EBF43D5: ScAttrArray::SetPattern(int, ScPatternAttr 
const*, bool) (attarray.hxx:148)
     ==143282==    by 0x1EBD9068: ScColumn::ApplyAttr(int, SfxPoolItem const&) 
(column.cxx:634)
     ==143282==    by 0x1EC6C1EB: ScColumn::SetNumberFormat(int, unsigned int) 
(column2.cxx:3094)
     ==143282==    by 0x1F1CB737: ScTable::SetNumberFormat(short, int, unsigned 
int) (table2.cxx:2238)
     ==143282==    by 0x1EE3F135: ScDocument::SetNumberFormat(ScAddress const&, 
unsigned int) (document.cxx:3717)
     ==143282==    by 0x1F09CCA5: 
ScFormulaCell::InterpretTail(ScInterpreterContext&, 
ScFormulaCell::ScInterpretTailParameter) (formulacell.cxx:2155)
     ==143282==    by 0x1F099D9F: ScFormulaCell::Interpret(int, int) 
(formulacell.cxx:1615)
     ==143282==    by 0x1ECC048D: ScFormulaCell::MaybeInterpret() 
(formulacell.hxx:465)
     ==143282==    by 0x1F09F5C8: ScFormulaCell::IsValue() 
(formulacell.cxx:2760)
     ==143282==    by 0x1EA82355: (anonymous 
namespace)::hasNumericImpl(CellType, ScFormulaCell*) (cellvalue.cxx:155)
     ==143282==    by 0x1EA822FA: ScRefCellValue::hasNumeric() const 
(cellvalue.cxx:624)
     ==143282==    by 0x2028E876: ScOutputData::LayoutStrings(bool, bool, 
ScAddress const&) (output2.cxx:1676)
     ==143282==    by 0x2028D4A8: ScOutputData::DrawStrings(bool) 
(output2.cxx:1473)
     ==143282==    by 0x202D9879: ScPrintFunc::PrintArea(short, int, short, 
int, long, long, bool, bool, bool, bool) (printfun.cxx:1675)
     ==143282==    by 0x202DD459: ScPrintFunc::PrintPage(long, short, int, 
short, int, bool, ScPreviewLocationData*) (printfun.cxx:2301)
     ==143282==    by 0x202DF491: ScPrintFunc::DoPrint(MultiSelection const&, 
long, long, bool, ScPreviewLocationData*) (printfun.cxx:2713)
     ==143282==    by 0x20031888: ScModelObj::render(int, 
com::sun::star::uno::Any const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(docuno.cxx:2259)
     ==143282==    by 0x30C1A485: PDFExport::ExportSelection(vcl::PDFWriter&, 
com::sun::star::uno::Reference<com::sun::star::view::XRenderable> const&, 
com::sun::star::uno::Any const&, StringRangeEnumerator const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&, int) 
(pdfexport.cxx:219)
    
    Change-Id: Idf19b79f5aef7e07666249f5f9ec510003a3f886
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134362
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <[email protected]>

diff --git a/sc/inc/document.hxx b/sc/inc/document.hxx
index 76798748e04f..eeeb98440b08 100644
--- a/sc/inc/document.hxx
+++ b/sc/inc/document.hxx
@@ -569,6 +569,8 @@ private:
     bool                mbFinalTrackFormulas    : 1;
     // This indicates if a ScDocShell::DoRecalc() or 
ScDocShell::DoHardRecalc() is in progress.
     bool                mbDocShellRecalc        : 1;
+    // This indicates if a ScOutputData::LayoutStrings() is in progress.
+    bool                mbLayoutStrings         : 1;
 
     size_t              mnMutationGuardFlags;
 
@@ -2616,6 +2618,9 @@ public:
     bool IsInDocShellRecalc() const   { return mbDocShellRecalc; }
     void SetDocShellRecalc(bool bSet) { mbDocShellRecalc = bSet; }
 
+    bool IsInLayoutStrings() const   { return mbLayoutStrings; }
+    void SetLayoutStrings(bool bSet) { mbLayoutStrings = bSet; }
+
     /**
      * Serializes the specified sheet's geometry data.
      *
diff --git a/sc/qa/extras/scpdfexport.cxx b/sc/qa/extras/scpdfexport.cxx
index 61c9376d5ac2..a0613de74e9a 100644
--- a/sc/qa/extras/scpdfexport.cxx
+++ b/sc/qa/extras/scpdfexport.cxx
@@ -72,6 +72,7 @@ public:
     void testTdf143978();
     void testTdf84012();
     void testTdf78897();
+    void testForcepoint97();
 
     CPPUNIT_TEST_SUITE(ScPDFExportTest);
     CPPUNIT_TEST(testExportRange_Tdf120161);
@@ -81,6 +82,7 @@ public:
     CPPUNIT_TEST(testTdf143978);
     CPPUNIT_TEST(testTdf84012);
     CPPUNIT_TEST(testTdf78897);
+    CPPUNIT_TEST(testForcepoint97);
     CPPUNIT_TEST_SUITE_END();
 };
 
@@ -588,6 +590,18 @@ void ScPDFExportTest::testTdf78897()
     CPPUNIT_ASSERT_EQUAL(OUString(" 11.00 11.00 "), aActualText);
 }
 
+// just needs to not crash on export to pdf
+void ScPDFExportTest::testForcepoint97()
+{
+    mxComponent = loadFromDesktop(m_directories.getURLFromSrc(DATA_DIRECTORY) 
+ "forcepoint97.xlsx",
+                                  "com.sun.star.sheet.SpreadsheetDocument");
+    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
+
+    // A1:H81
+    ScRange range1(0, 0, 0, 7, 81, 0);
+    std::shared_ptr<utl::TempFile> pPDFFile = exportToPDF(xModel, range1);
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(ScPDFExportTest);
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sc/qa/extras/testdocuments/forcepoint97.xlsx 
b/sc/qa/extras/testdocuments/forcepoint97.xlsx
new file mode 100644
index 000000000000..152fbbc45a9f
Binary files /dev/null and b/sc/qa/extras/testdocuments/forcepoint97.xlsx differ
diff --git a/sc/source/core/data/documen2.cxx b/sc/source/core/data/documen2.cxx
index a6aebc039219..4970a1d333a1 100644
--- a/sc/source/core/data/documen2.cxx
+++ b/sc/source/core/data/documen2.cxx
@@ -186,6 +186,7 @@ ScDocument::ScDocument( ScDocumentMode eMode, 
SfxObjectShell* pDocShell ) :
         mbTrackFormulasPending(false),
         mbFinalTrackFormulas(false),
         mbDocShellRecalc(false),
+        mbLayoutStrings(false),
         mnMutationGuardFlags(0)
 {
     maPreviewSelection = { *mxSheetLimits };
diff --git a/sc/source/core/data/formulacell.cxx 
b/sc/source/core/data/formulacell.cxx
index b3f07b4b5207..93cc0697090d 100644
--- a/sc/source/core/data/formulacell.cxx
+++ b/sc/source/core/data/formulacell.cxx
@@ -2149,7 +2149,8 @@ void ScFormulaCell::InterpretTail( ScInterpreterContext& 
rContext, ScInterpretTa
             // XXX if mbNeedsNumberFormat was set even if the current format
             // was not General then we'd have to obtain the current format here
             // and check at least the types.
-            if (bSetFormat && (bForceNumberFormat || ((nFormatIndex % 
SV_COUNTRY_LANGUAGE_OFFSET) != 0)))
+            const bool bSetNumberFormat = bSetFormat && (bForceNumberFormat || 
((nFormatIndex % SV_COUNTRY_LANGUAGE_OFFSET) != 0));
+            if (bSetNumberFormat && !rDocument.IsInLayoutStrings())
             {
                 // set number format explicitly
                 if (!rDocument.IsThreadedGroupCalcInProgress())
diff --git a/sc/source/ui/view/output2.cxx b/sc/source/ui/view/output2.cxx
index ce247163c853..df447744e56e 100644
--- a/sc/source/ui/view/output2.cxx
+++ b/sc/source/ui/view/output2.cxx
@@ -74,6 +74,7 @@
 #include <scopetools.hxx>
 
 #include <com/sun/star/i18n/DirectionProperty.hpp>
+#include <comphelper/scopeguard.hxx>
 #include <comphelper/string.hxx>
 
 #include <memory>
@@ -1518,6 +1519,12 @@ void ScOutputData::DrawStrings( bool bPixelToLogic )
 
 tools::Rectangle ScOutputData::LayoutStrings(bool bPixelToLogic, bool bPaint, 
const ScAddress &rAddress)
 {
+    bool bOrigIsInLayoutStrings = mpDoc->IsInLayoutStrings();
+    mpDoc->SetLayoutStrings(true);
+    comphelper::ScopeGuard g([this, bOrigIsInLayoutStrings] {
+        mpDoc->SetLayoutStrings(bOrigIsInLayoutStrings);
+    });
+
     OSL_ENSURE( mpDev == mpRefDevice ||
                 mpDev->GetMapMode().GetMapUnit() == 
mpRefDevice->GetMapMode().GetMapUnit(),
                 "LayoutStrings: different MapUnits ?!?!" );
commit e2f77e9b1d6d171da32ba13c2987b4be41231611
Author:     Caolán McNamara <[email protected]>
AuthorDate: Sat May 14 16:27:46 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    tdf#149079 don't skip disposing DnDListener
    
    even if there is no longer a DropTarget don't return early and
    omit to inform listeners of the disposing
    
    Change-Id: I6ce7fe1664049a9e0a88b549b1c8c94ec8072c1f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134193
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/editeng/source/editeng/impedit.cxx 
b/editeng/source/editeng/impedit.cxx
index d43e3053489f..b2ce6d198752 100644
--- a/editeng/source/editeng/impedit.cxx
+++ b/editeng/source/editeng/impedit.cxx
@@ -2693,18 +2693,18 @@ void ImpEditView::RemoveDragAndDropListeners()
     else if (auto xWindow = GetWindow())
         xDropTarget = xWindow->GetDropTarget();
 
-    if (!xDropTarget.is())
-        return;
-
-    css::uno::Reference<css::datatransfer::dnd::XDragGestureRecognizer> 
xDragGestureRecognizer(xDropTarget, uno::UNO_QUERY);
-    if (xDragGestureRecognizer.is())
+    if (xDropTarget.is())
     {
-        uno::Reference<datatransfer::dnd::XDragGestureListener> 
xDGL(mxDnDListener, uno::UNO_QUERY);
-        xDragGestureRecognizer->removeDragGestureListener(xDGL);
-    }
+        css::uno::Reference<css::datatransfer::dnd::XDragGestureRecognizer> 
xDragGestureRecognizer(xDropTarget, uno::UNO_QUERY);
+        if (xDragGestureRecognizer.is())
+        {
+            uno::Reference<datatransfer::dnd::XDragGestureListener> 
xDGL(mxDnDListener, uno::UNO_QUERY);
+            xDragGestureRecognizer->removeDragGestureListener(xDGL);
+        }
 
-    uno::Reference<datatransfer::dnd::XDropTargetListener> xDTL(mxDnDListener, 
uno::UNO_QUERY);
-    xDropTarget->removeDropTargetListener(xDTL);
+        uno::Reference<datatransfer::dnd::XDropTargetListener> 
xDTL(mxDnDListener, uno::UNO_QUERY);
+        xDropTarget->removeDropTargetListener(xDTL);
+    }
 
     if ( mxDnDListener.is() )
     {
commit deb1b677048b77f31a3f29bd033cfb9e61f47fcc
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu May 12 12:10:53 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    tdf#143612: map SecondaryRefValue in form pdf export
    
    Change-Id: I590784eb94fb6f4f3a20c4f6d8e3fb618f60d0fc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134227
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134242
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/include/vcl/pdfwriter.hxx b/include/vcl/pdfwriter.hxx
index 3dfcc31e0994..822b6870c89c 100644
--- a/include/vcl/pdfwriter.hxx
+++ b/include/vcl/pdfwriter.hxx
@@ -333,6 +333,7 @@ public:
     {
         bool                Checked;
         OUString            OnValue; // the value of the checkbox if it is 
selected
+        OUString            OffValue; // the value of the checkbox if it is 
not selected
 
         CheckBoxWidget()
                 : AnyWidget( vcl::PDFWriter::CheckBox ),
@@ -350,6 +351,7 @@ public:
         bool                Selected;
         sal_Int32           RadioGroup;
         OUString       OnValue; // the value of the radio button if it is 
selected
+        OUString       OffValue; // the value of the radio button if it is not 
selected
 
         RadioButtonWidget()
                 : AnyWidget( vcl::PDFWriter::RadioButton ),
diff --git a/toolkit/source/helper/formpdfexport.cxx 
b/toolkit/source/helper/formpdfexport.cxx
index 5f04f69f7721..aa5224e377f2 100644
--- a/toolkit/source/helper/formpdfexport.cxx
+++ b/toolkit/source/helper/formpdfexport.cxx
@@ -572,6 +572,14 @@ namespace toolkitform
                 catch(...)
                 {
                 }
+
+                try
+                {
+                    xModelProps->getPropertyValue( "SecondaryRefValue" ) >>= 
pCheckBoxWidget->OffValue;
+                }
+                catch(...)
+                {
+                }
             }
 
 
@@ -591,6 +599,14 @@ namespace toolkitform
                 catch(...)
                 {
                 }
+
+                try
+                {
+                    xModelProps->getPropertyValue( "SecondaryRefValue" ) >>= 
pRadioWidget->OffValue;
+                }
+                catch(...)
+                {
+                }
             }
 
 
diff --git a/vcl/inc/pdf/pdfwriter_impl.hxx b/vcl/inc/pdf/pdfwriter_impl.hxx
index b8bdc3825eee..f6a9bba96f6a 100644
--- a/vcl/inc/pdf/pdfwriter_impl.hxx
+++ b/vcl/inc/pdf/pdfwriter_impl.hxx
@@ -463,7 +463,8 @@ struct PDFWidget : public PDFAnnotation
     sal_Int32                   m_nParent; // if not 0, parent's object number
     std::vector<sal_Int32>      m_aKids; // widget children, contains object 
numbers
     std::vector<sal_Int32>      m_aKidsIndex; // widget children, contains 
index to m_aWidgets
-    OUString               m_aOnValue;
+    OUString                    m_aOnValue;
+    OUString                    m_aOffValue;
     sal_Int32                   m_nTabOrder; // lowest number gets first in 
tab order
     sal_Int32                   m_nRadioGroup;
     sal_Int32                   m_nMaxLen;
diff --git a/vcl/qa/cppunit/pdfexport/data/tdf148442.odt 
b/vcl/qa/cppunit/pdfexport/data/tdf148442.odt
index 31fea48e62b2..819595df22a2 100644
Binary files a/vcl/qa/cppunit/pdfexport/data/tdf148442.odt and 
b/vcl/qa/cppunit/pdfexport/data/tdf148442.odt differ
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx 
b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 19c823b7f2bb..95c6325c5a26 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -858,6 +858,7 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
                 CPPUNIT_ASSERT_EQUAL(OString("Yes"), pAS->GetValue());
                 CPPUNIT_ASSERT(!pN->GetItems().count("ref"));
                 CPPUNIT_ASSERT(pN->GetItems().count("Yes"));
+                CPPUNIT_ASSERT(pN->GetItems().count("Off"));
             }
             else if (nBtnCount == 2)
             {
@@ -867,6 +868,7 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
                 // Without the fix in place, this test would have failed here
                 CPPUNIT_ASSERT(pN->GetItems().count("ref"));
                 CPPUNIT_ASSERT(!pN->GetItems().count("Yes"));
+                CPPUNIT_ASSERT(pN->GetItems().count("Off"));
             }
             else
             {
@@ -874,6 +876,10 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
                 CPPUNIT_ASSERT_EQUAL(OString("Off"), pAS->GetValue());
                 CPPUNIT_ASSERT(pN->GetItems().count("ref"));
                 CPPUNIT_ASSERT(!pN->GetItems().count("Yes"));
+
+                // tdf#143612: Without the fix in place, this test would have 
failed here
+                CPPUNIT_ASSERT(!pN->GetItems().count("Off"));
+                CPPUNIT_ASSERT(pN->GetItems().count("refOff"));
             }
         }
     }
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx 
b/vcl/source/gdi/pdfwriter_impl.cxx
index 1dcadd84b349..06daee9efadc 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -4186,6 +4186,25 @@ bool PDFWriterImpl::emitWidgetAnnotations()
                         SAL_INFO("vcl.pdfwriter", "error: CheckBox without 
\"Yes\" stream" );
                 }
             }
+
+            if ( !rWidget.m_aOffValue.isEmpty() )
+            {
+                auto app_it = rWidget.m_aAppearances.find( "N" );
+                if( app_it != rWidget.m_aAppearances.end() )
+                {
+                    auto stream_it = app_it->second.find( "Off" );
+                    if( stream_it != app_it->second.end() )
+                    {
+                        SvMemoryStream* pStream = stream_it->second;
+                        app_it->second.erase( stream_it );
+                        OStringBuffer aBuf( rWidget.m_aOffValue.getLength()*2 
);
+                        appendName( rWidget.m_aOffValue, aBuf );
+                        (app_it->second)[ aBuf.makeStringAndClear() ] = 
pStream;
+                    }
+                    else
+                        SAL_INFO("vcl.pdfwriter", "error: CheckBox without 
\"Off\" stream" );
+                }
+            }
         }
 
         OStringBuffer aLine( 1024 );
@@ -10743,6 +10762,26 @@ void PDFWriterImpl::ensureUniqueRadioOnValues()
                         SAL_INFO("vcl.pdfwriter", "error: RadioButton without 
\"Yes\" stream" );
                 }
             }
+
+            if ( !rKid.m_aOffValue.isEmpty() )
+            {
+                auto app_it = rKid.m_aAppearances.find( "N" );
+                if( app_it != rKid.m_aAppearances.end() )
+                {
+                    auto stream_it = app_it->second.find( "Off" );
+                    if( stream_it != app_it->second.end() )
+                    {
+                        SvMemoryStream* pStream = stream_it->second;
+                        app_it->second.erase( stream_it );
+                        OStringBuffer aBuf( rKid.m_aOffValue.getLength()*2 );
+                        appendName( rKid.m_aOffValue, aBuf );
+                        (app_it->second)[ aBuf.makeStringAndClear() ] = 
pStream;
+                    }
+                    else
+                        SAL_INFO("vcl.pdfwriter", "error: RadioButton without 
\"Off\" stream" );
+                }
+            }
+
             // update selected radio button
             if( rKid.m_aValue != "Off" )
             {
@@ -10860,6 +10899,7 @@ sal_Int32 PDFWriterImpl::createControl( const 
PDFWriter::AnyWidget& rControl, sa
 
         rNewWidget.m_aValue     = "Off";
         rNewWidget.m_aOnValue   = rBtn.OnValue;
+        rNewWidget.m_aOffValue   = rBtn.OffValue;
         if( rRadioButton.m_aValue.isEmpty() && rBtn.Selected )
         {
             rNewWidget.m_aValue     = rNewWidget.m_aOnValue;
@@ -10882,6 +10922,7 @@ sal_Int32 PDFWriterImpl::createControl( const 
PDFWriter::AnyWidget& rControl, sa
         rNewWidget.m_aValue
             = rBox.Checked ? std::u16string_view(u"Yes") : 
std::u16string_view(u"Off" );
         rNewWidget.m_aOnValue   = rBox.OnValue;
+        rNewWidget.m_aOffValue   = rBox.OffValue;
         // create default appearance before m_aRect gets transformed
         createDefaultCheckBoxAppearance( rNewWidget, rBox );
     }
commit 6ed4f5eeff60b72db8a49c9f76a64db4eb044b60
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu May 12 10:48:00 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    related: tdf#148442: do not replace 'Yes' if onValue is empty
    
    Change-Id: I748422dfbe7a385f4206c5d129eb3091289a180d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134220
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134241
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/toolkit/source/helper/formpdfexport.cxx 
b/toolkit/source/helper/formpdfexport.cxx
index 8011ebf9e616..5f04f69f7721 100644
--- a/toolkit/source/helper/formpdfexport.cxx
+++ b/toolkit/source/helper/formpdfexport.cxx
@@ -571,7 +571,6 @@ namespace toolkitform
                 }
                 catch(...)
                 {
-                    pCheckBoxWidget->OnValue = "On";
                 }
             }
 
@@ -591,7 +590,6 @@ namespace toolkitform
                 }
                 catch(...)
                 {
-                    pRadioWidget->OnValue = "On";
                 }
             }
 
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx 
b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 32de9047ce00..19c823b7f2bb 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -857,6 +857,7 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
                 CPPUNIT_ASSERT_EQUAL(OString("Checkbox1"), pT->GetValue());
                 CPPUNIT_ASSERT_EQUAL(OString("Yes"), pAS->GetValue());
                 CPPUNIT_ASSERT(!pN->GetItems().count("ref"));
+                CPPUNIT_ASSERT(pN->GetItems().count("Yes"));
             }
             else if (nBtnCount == 2)
             {
@@ -865,12 +866,14 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
 
                 // Without the fix in place, this test would have failed here
                 CPPUNIT_ASSERT(pN->GetItems().count("ref"));
+                CPPUNIT_ASSERT(!pN->GetItems().count("Yes"));
             }
             else
             {
                 CPPUNIT_ASSERT_EQUAL(OString("Checkbox3"), pT->GetValue());
                 CPPUNIT_ASSERT_EQUAL(OString("Off"), pAS->GetValue());
                 CPPUNIT_ASSERT(pN->GetItems().count("ref"));
+                CPPUNIT_ASSERT(!pN->GetItems().count("Yes"));
             }
         }
     }
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx 
b/vcl/source/gdi/pdfwriter_impl.cxx
index 2915220cf2ec..1dcadd84b349 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -4168,20 +4168,23 @@ bool PDFWriterImpl::emitWidgetAnnotations()
 
         if( rWidget.m_eType == PDFWriter::CheckBox )
         {
-            auto app_it = rWidget.m_aAppearances.find( "N" );
-            if( app_it != rWidget.m_aAppearances.end() )
+            if ( !rWidget.m_aOnValue.isEmpty() )
             {
-                auto stream_it = app_it->second.find( "Yes" );
-                if( stream_it != app_it->second.end() )
+                auto app_it = rWidget.m_aAppearances.find( "N" );
+                if( app_it != rWidget.m_aAppearances.end() )
                 {
-                    SvMemoryStream* pStream = stream_it->second;
-                    app_it->second.erase( stream_it );
-                    OStringBuffer aBuf( rWidget.m_aOnValue.getLength()*2 );
-                    appendName( rWidget.m_aOnValue, aBuf );
-                    (app_it->second)[ aBuf.makeStringAndClear() ] = pStream;
+                    auto stream_it = app_it->second.find( "Yes" );
+                    if( stream_it != app_it->second.end() )
+                    {
+                        SvMemoryStream* pStream = stream_it->second;
+                        app_it->second.erase( stream_it );
+                        OStringBuffer aBuf( rWidget.m_aOnValue.getLength()*2 );
+                        appendName( rWidget.m_aOnValue, aBuf );
+                        (app_it->second)[ aBuf.makeStringAndClear() ] = 
pStream;
+                    }
+                    else
+                        SAL_INFO("vcl.pdfwriter", "error: CheckBox without 
\"Yes\" stream" );
                 }
-                else
-                    SAL_INFO("vcl.pdfwriter", "error: CheckBox without \"Yes\" 
stream" );
             }
         }
 
@@ -10722,20 +10725,23 @@ void PDFWriterImpl::ensureUniqueRadioOnValues()
         for (auto const& nKidIndex : rGroupWidget.m_aKidsIndex)
         {
             PDFWidget& rKid = m_aWidgets[nKidIndex];
-            auto app_it = rKid.m_aAppearances.find( "N" );
-            if( app_it != rKid.m_aAppearances.end() )
+            if ( !rKid.m_aOnValue.isEmpty() )
             {
-                auto stream_it = app_it->second.find( "Yes" );
-                if( stream_it != app_it->second.end() )
+                auto app_it = rKid.m_aAppearances.find( "N" );
+                if( app_it != rKid.m_aAppearances.end() )
                 {
-                    SvMemoryStream* pStream = stream_it->second;
-                    app_it->second.erase( stream_it );
-                    OStringBuffer aBuf( rKid.m_aOnValue.getLength()*2 );
-                    appendName( rKid.m_aOnValue, aBuf );
-                    (app_it->second)[ aBuf.makeStringAndClear() ] = pStream;
+                    auto stream_it = app_it->second.find( "Yes" );
+                    if( stream_it != app_it->second.end() )
+                    {
+                        SvMemoryStream* pStream = stream_it->second;
+                        app_it->second.erase( stream_it );
+                        OStringBuffer aBuf( rKid.m_aOnValue.getLength()*2 );
+                        appendName( rKid.m_aOnValue, aBuf );
+                        (app_it->second)[ aBuf.makeStringAndClear() ] = 
pStream;
+                    }
+                    else
+                        SAL_INFO("vcl.pdfwriter", "error: RadioButton without 
\"Yes\" stream" );
                 }
-                else
-                    SAL_INFO("vcl.pdfwriter", "error: RadioButton without 
\"Yes\" stream" );
             }
             // update selected radio button
             if( rKid.m_aValue != "Off" )
commit 1de5627ecea8d9331de1977bf521de713b8b1b5f
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed May 11 14:35:20 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    tdf#148442: map RefValue property to onValue in pdf
    
    Similar to what it's already done for radiobuttons
    Change-Id: I708d23dc5f9d4470a9850d7ecc60bd71fada594e
    
    Change-Id: I34107c757b0e0933f392a6d0845fa0d2e07aed62
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134170
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 6ee5fb6d32147e180552f66e615d1de932fdcf9c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134176

diff --git a/include/vcl/pdfwriter.hxx b/include/vcl/pdfwriter.hxx
index 6e8d68cfcff9..3dfcc31e0994 100644
--- a/include/vcl/pdfwriter.hxx
+++ b/include/vcl/pdfwriter.hxx
@@ -332,6 +332,7 @@ public:
     struct CheckBoxWidget final : public AnyWidget
     {
         bool                Checked;
+        OUString            OnValue; // the value of the checkbox if it is 
selected
 
         CheckBoxWidget()
                 : AnyWidget( vcl::PDFWriter::CheckBox ),
diff --git a/toolkit/source/helper/formpdfexport.cxx 
b/toolkit/source/helper/formpdfexport.cxx
index 9061d3ec7bce..8011ebf9e616 100644
--- a/toolkit/source/helper/formpdfexport.cxx
+++ b/toolkit/source/helper/formpdfexport.cxx
@@ -564,6 +564,15 @@ namespace toolkitform
                 if( ! (xModelProps->getPropertyValue( FM_PROP_STATE ) >>= 
nState) )
                     SAL_WARN("toolkit.helper", "describePDFControl: unable to 
get property " << FM_PROP_STATE);
                 pCheckBoxWidget->Checked = ( nState != 0 );
+
+                try
+                {
+                    xModelProps->getPropertyValue( "RefValue" ) >>= 
pCheckBoxWidget->OnValue;
+                }
+                catch(...)
+                {
+                    pCheckBoxWidget->OnValue = "On";
+                }
             }
 
 
diff --git a/vcl/qa/cppunit/pdfexport/data/tdf148442.odt 
b/vcl/qa/cppunit/pdfexport/data/tdf148442.odt
new file mode 100644
index 000000000000..31fea48e62b2
Binary files /dev/null and b/vcl/qa/cppunit/pdfexport/data/tdf148442.odt differ
diff --git a/vcl/qa/cppunit/pdfexport/pdfexport.cxx 
b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
index 19afd5731d3a..32de9047ce00 100644
--- a/vcl/qa/cppunit/pdfexport/pdfexport.cxx
+++ b/vcl/qa/cppunit/pdfexport/pdfexport.cxx
@@ -818,6 +818,64 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf108963)
     CPPUNIT_ASSERT_EQUAL(1, nYellowPathCount);
 }
 
+CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf148442)
+{
+    vcl::filter::PDFDocument aDocument;
+    load(u"tdf148442.odt", aDocument);
+
+    // The document has one page.
+    std::vector<vcl::filter::PDFObjectElement*> aPages = aDocument.GetPages();
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(1), aPages.size());
+
+    auto pAnnots = 
dynamic_cast<vcl::filter::PDFArrayElement*>(aPages[0]->Lookup("Annots"));
+    CPPUNIT_ASSERT(pAnnots);
+    CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(3), 
pAnnots->GetElements().size());
+
+    sal_uInt32 nBtnCount = 0;
+    for (const auto& aElement : aDocument.GetElements())
+    {
+        auto pObject = 
dynamic_cast<vcl::filter::PDFObjectElement*>(aElement.get());
+        if (!pObject)
+            continue;
+        auto pType = 
dynamic_cast<vcl::filter::PDFNameElement*>(pObject->Lookup("FT"));
+        if (pType && pType->GetValue() == "Btn")
+        {
+            ++nBtnCount;
+            auto pT = 
dynamic_cast<vcl::filter::PDFLiteralStringElement*>(pObject->Lookup("T"));
+            CPPUNIT_ASSERT(pT);
+            auto pAS = 
dynamic_cast<vcl::filter::PDFNameElement*>(pObject->Lookup("AS"));
+            CPPUNIT_ASSERT(pAS);
+
+            auto pAP = 
dynamic_cast<vcl::filter::PDFDictionaryElement*>(pObject->Lookup("AP"));
+            CPPUNIT_ASSERT(pAP);
+            auto pN = 
dynamic_cast<vcl::filter::PDFDictionaryElement*>(pAP->LookupElement("N"));
+            CPPUNIT_ASSERT(pN);
+            CPPUNIT_ASSERT_EQUAL(static_cast<size_t>(2), 
pN->GetItems().size());
+
+            if (nBtnCount == 1)
+            {
+                CPPUNIT_ASSERT_EQUAL(OString("Checkbox1"), pT->GetValue());
+                CPPUNIT_ASSERT_EQUAL(OString("Yes"), pAS->GetValue());
+                CPPUNIT_ASSERT(!pN->GetItems().count("ref"));
+            }
+            else if (nBtnCount == 2)
+            {
+                CPPUNIT_ASSERT_EQUAL(OString("Checkbox2"), pT->GetValue());
+                CPPUNIT_ASSERT_EQUAL(OString("Yes"), pAS->GetValue());
+
+                // Without the fix in place, this test would have failed here
+                CPPUNIT_ASSERT(pN->GetItems().count("ref"));
+            }
+            else
+            {
+                CPPUNIT_ASSERT_EQUAL(OString("Checkbox3"), pT->GetValue());
+                CPPUNIT_ASSERT_EQUAL(OString("Off"), pAS->GetValue());
+                CPPUNIT_ASSERT(pN->GetItems().count("ref"));
+            }
+        }
+    }
+}
+
 CPPUNIT_TEST_FIXTURE(PdfExportTest, testTdf118244_radioButtonGroup)
 {
     vcl::filter::PDFDocument aDocument;
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx 
b/vcl/source/gdi/pdfwriter_impl.cxx
index eea47fc48fe3..2915220cf2ec 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -4166,6 +4166,25 @@ bool PDFWriterImpl::emitWidgetAnnotations()
     {
         PDFWidget& rWidget = m_aWidgets[a];
 
+        if( rWidget.m_eType == PDFWriter::CheckBox )
+        {
+            auto app_it = rWidget.m_aAppearances.find( "N" );
+            if( app_it != rWidget.m_aAppearances.end() )
+            {
+                auto stream_it = app_it->second.find( "Yes" );
+                if( stream_it != app_it->second.end() )
+                {
+                    SvMemoryStream* pStream = stream_it->second;
+                    app_it->second.erase( stream_it );
+                    OStringBuffer aBuf( rWidget.m_aOnValue.getLength()*2 );
+                    appendName( rWidget.m_aOnValue, aBuf );
+                    (app_it->second)[ aBuf.makeStringAndClear() ] = pStream;
+                }
+                else
+                    SAL_INFO("vcl.pdfwriter", "error: CheckBox without \"Yes\" 
stream" );
+            }
+        }
+
         OStringBuffer aLine( 1024 );
         OStringBuffer aValue( 256 );
         aLine.append( rWidget.m_nObject );
@@ -10856,6 +10875,7 @@ sal_Int32 PDFWriterImpl::createControl( const 
PDFWriter::AnyWidget& rControl, sa
 
         rNewWidget.m_aValue
             = rBox.Checked ? std::u16string_view(u"Yes") : 
std::u16string_view(u"Off" );
+        rNewWidget.m_aOnValue   = rBox.OnValue;
         // create default appearance before m_aRect gets transformed
         createDefaultCheckBoxAppearance( rNewWidget, rBox );
     }
commit 03053e60d24618d6481d67013c090497d55378ec
Author:     Julien Nabet <[email protected]>
AuthorDate: Thu May 12 13:35:22 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    tdf#119686: fix tiff with 1 bit per pixel
    
    On the 30 pixels width images, the 3 first bytes were ok,
    that's why the 24 first pixels of each line was ok.
    The pb was in the fourth byte, you must read each bit of this last byte
    until reaching 30 pixels, so 6 bits (since width 30 corresponds to 3 * 8 + 
(8 - 2)).
    Here LO always shifted this byte with the same value, so used the value of 
the first bit for the last 6 bits of the last byte.
    => just decrement the shift value at the end of each loop
    
    With this patch initial, attachment of the bugtracker 
https://bugs.documentfoundation.org/attachment.cgi?id=144656
    and the more complex one 
https://bugs.documentfoundation.org/attachment.cgi?id=144656 are ok
    
    Change-Id: I17339c54d6822c724184f167fb3a25b240e06543
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134235
    Tested-by: Julien Nabet <[email protected]>
    Reviewed-by: Julien Nabet <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134248
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/vcl/source/filter/itiff/itiff.cxx 
b/vcl/source/filter/itiff/itiff.cxx
index cad78f1b7d1f..5ce017dea9c7 100644
--- a/vcl/source/filter/itiff/itiff.cxx
+++ b/vcl/source/filter/itiff/itiff.cxx
@@ -1120,6 +1120,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                             while ( nx < nImageWidth )
                             {
                                 SetPixel(nY, nx++, ( nByteVal >> nShift ) & 1);
+                                --nShift;
                             }
                         }
                     }
commit 7c4303fc171c005b3927355dee25f72898f83f8f
Author:     Eike Rathke <[email protected]>
AuthorDate: Fri May 13 01:30:20 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Wed May 25 09:27:14 2022 +0200

    Use interpreter stack to determine JumpMatrix context, tdf#148863 follow-up
    
    pJumpMatrix may or may not be set; actually may need some rework,
    but get this straight here.
    
    Change-Id: I0948e6aeb6637e7a5009a17f63f01d0733c0205c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134252
    Reviewed-by: Eike Rathke <[email protected]>
    Tested-by: Jenkins
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134277

diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index 87bc8e5fe8d6..42d6dde67df2 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -1744,10 +1744,10 @@ void ScInterpreter::ScRandomImpl( const 
std::function<double( double fFirst, dou
         // In JumpMatrix context use its dimensions for the return matrix; the
         // formula cell range selected may differ, for example if the result is
         // to be transposed.
-        if (pJumpMatrix)
+        if (GetStackType(1) == svJumpMatrix)
         {
             SCSIZE nC, nR;
-            pJumpMatrix->GetDimensions( nC, nR);
+            pStack[sp-1]->GetJumpMatrix()->GetDimensions( nC, nR);
             nCols = std::max<SCCOL>(0, static_cast<SCCOL>(nC));
             nRows = std::max<SCROW>(0, static_cast<SCROW>(nR));
         }
commit 6c00011507268ab35694e62dc2f420d1eaaab89e

... etc. - the rest is truncated

Reply via email to