Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Thiago Macieira
On Thursday, 30 January 2020 09:16:19 PST Olivier Goffart wrote: > > I actually found that the patch applies to 5.7, and even qt4 with the > > proper modifications. Is there something else in the code that limits > > the affected version or maybe it does affects older versions too? > > The patch j

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Thiago Macieira
On Thursday, 30 January 2020 09:09:47 PST Olivier Goffart wrote: > > This is similar to a TOCTOU attack, but I couldn't come up with a > > reasonable attack scenario. If the interposing DLL has metadata saying > > not to load, QLibrary will find the actual plugin later and will load > > that. The w

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Henry Skoglund
On 2020-01-30 18:09, Olivier Goffart wrote: On 30/01/20 17:12, Thiago Macieira wrote: On Thursday, 30 January 2020 03:05:50 PST Olivier Goffart wrote: $PWD is not the same as the binary dir (QCoreApplication::applicationDirPath) The later is still searched while looking for plugin. (so that co

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Olivier Goffart
On 30/01/20 17:16, Lisandro Damián Nicanor Pérez Meyer wrote: Hi Thiago! On Wed, 29 Jan 2020 at 22:19, Thiago Macieira wrote: [snip] Issue 2) CVE-2020-0570 Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C * Vendor: Qt Project * Product: Qt * Versions affected: 5.1

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Olivier Goffart
On 30/01/20 17:12, Thiago Macieira wrote: On Thursday, 30 January 2020 03:05:50 PST Olivier Goffart wrote: $PWD is not the same as the binary dir (QCoreApplication::applicationDirPath) The later is still searched while looking for plugin. (so that covers the case where plugin is in the folder ne

Re: [Development] Qt 5.13 & 5.14 add device-independent pixels to device-dependent

2020-01-30 Thread Thiago Macieira
On Thursday, 30 January 2020 06:34:02 PST Morten Sørvig wrote: > macOS works this way, Windows doesn’t. I think the linux desktop > environments could work this way when using Wayland, but I’m not sure what > actually do. (The test is; does a 2x screen show up as a very large screen, > or not) > >

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Lisandro Damián Nicanor Pérez Meyer
Hi Thiago! On Wed, 29 Jan 2020 at 22:19, Thiago Macieira wrote: [snip] > Issue 2) CVE-2020-0570 > Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C > * Vendor: Qt Project > * Product: Qt > * Versions affected: 5.12.0 through 5.14.0 I actually found that the patch app

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Thiago Macieira
On Thursday, 30 January 2020 03:05:50 PST Olivier Goffart wrote: > $PWD is not the same as the binary dir > (QCoreApplication::applicationDirPath) The later is still searched while > looking for plugin. (so that covers the case where plugin is in the folder > next to the binary) > > But I am also

Re: [Development] Changes to Qt offering

2020-01-30 Thread Florian Bruhin
On Wed, Jan 29, 2020 at 05:22:04PM -0500, Matthew Woehlke wrote: > On 29/01/2020 17.13, Konstantin Shegunov wrote: > > On Wed, Jan 29, 2020 at 11:55 PM Matthew Woehlke wrote: > >> We need more open-source-meets-kickstarter... > > > > ehm, Patreon? > > Aside from issues with Patreon's reputation,

Re: [Development] Qt 5.13 & 5.14 add device-independent pixels to device-dependent

2020-01-30 Thread Florian Bruhin
On Tue, Jan 28, 2020 at 07:14:50PM -0800, Thiago Macieira wrote: > I don't know what makes KMail different. I thought it was the use of a > qtwebengine window, but the qtwebengine examples seem to work fine. FWIW I've had issues (and so had other qutebrowser users) with context menus appearing in

Re: [Development] Qt 5.13 & 5.14 add device-independent pixels to device-dependent

2020-01-30 Thread Morten Sørvig
> On 29 Jan 2020, at 04:14, Thiago Macieira wrote: > > On Tuesday, 28 January 2020 06:48:53 PST Morten Sørvig wrote: >> There are several possible solutions: >> >> 1) The scale factor for screen positions is 1: [the current choice] >> Simple to implement. Device-independent virtual geometry m

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Dominik Holland
Am 30.01.20 um 12:05 schrieb Olivier Goffart: > On 30/01/20 11:30, Dominik Holland wrote: >> Doesn't the first fix break the standard way of deploying plugins on >> windows ? I'm also not sure why this shouldn't affect windows ? >> >> Most applications using Qt on windows just deploy their plugins

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Olivier Goffart
On 30/01/20 11:30, Dominik Holland wrote: Doesn't the first fix break the standard way of deploying plugins on windows ? I'm also not sure why this shouldn't affect windows ? Most applications using Qt on windows just deploy their plugins in the folder next to the binary. Same like all dlls need

Re: [Development] Qt installer capabilities (was: Re: Changes to Qt offering)

2020-01-30 Thread Jani Heikkinen
> -Original Message- > From: Development On Behalf Of > André Somers > Sent: tiistai 28. tammikuuta 2020 16.59 > To: development@qt-project.org > Subject: [Development] Qt installer capabilities (was: Re: Changes to Qt > offering) > > Hi, > While on the topic of the installer and using a

Re: [Development] New Qt vulnerabilities

2020-01-30 Thread Dominik Holland
Doesn't the first fix break the standard way of deploying plugins on windows ? I'm also not sure why this shouldn't affect windows ? Most applications using Qt on windows just deploy their plugins in the folder next to the binary. Same like all dlls needed for the binary... I see how this fixes t

Re: [Development] Changes to Qt offering

2020-01-30 Thread James Maxwell
I run a small business. we are 2.5 developers (one is working half time), and our revenue is about 150 000 $. We do general development for other small businesses, from web applications to desktop software. Probably about half of our revenue is based on software where we use Qt. So we don't qualif