qt5-qtwebengine/qtwebengine-everywhere-src-5.10.1-CVE-2018-6033.patch
Kevin Kofler 4aaa039459 Fix (from 5.9.5) for incomplete, ineffective fix for CVE-2018-6033 in 5.10.1
* Sun Mar 18 2018 Kevin Kofler <Kevin@tigcc.ticalc.org> - 5.10.1-4
- Fix (from 5.9.5) for incomplete, ineffective fix for CVE-2018-6033 in 5.10.1
2018-03-18 16:36:09 +01:00

65 lines
2.6 KiB
Diff

From 1fd21185614dcae0c7a6e5647ba56cff0120f563 Mon Sep 17 00:00:00 2001
Message-Id: <1fd21185614dcae0c7a6e5647ba56cff0120f563.1521386919.git.kevin.kofler@chello.at>
From: Michal Klocek <michal.klocek@qt.io>
Date: Wed, 7 Mar 2018 18:36:25 +0100
Subject: [PATCH] Implement IsMostRecentDownloadItemAtFilePath call
Implement IsMostRecentDownloadItemAtFilePath
for download_manager_delegate_qt. This is required for
CVE-2018-6033.
Change-Id: I9f48dfa159d684f0fda894e68b81ff622aceaae2
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
---
src/core/download_manager_delegate_qt.cpp | 20 ++++++++++++++++++++
src/core/download_manager_delegate_qt.h | 2 ++
2 files changed, 22 insertions(+)
diff --git a/src/core/download_manager_delegate_qt.cpp b/src/core/download_manager_delegate_qt.cpp
index 40df9b3a..487a831e 100644
--- a/src/core/download_manager_delegate_qt.cpp
+++ b/src/core/download_manager_delegate_qt.cpp
@@ -293,6 +293,26 @@ void DownloadManagerDelegateQt::ChooseSavePath(content::WebContents *web_content
m_weakPtrFactory.GetWeakPtr()));
}
+bool DownloadManagerDelegateQt::IsMostRecentDownloadItemAtFilePath(content::DownloadItem *download)
+{
+ content::BrowserContext *context = download->GetBrowserContext();
+ std::vector<content::DownloadItem*> all_downloads;
+
+ content::DownloadManager* manager =
+ content::BrowserContext::GetDownloadManager(context);
+ if (manager)
+ manager->GetAllDownloads(&all_downloads);
+
+ for (const auto* item : all_downloads) {
+ if (item->GetGuid() == download->GetGuid() ||
+ item->GetTargetFilePath() != download->GetTargetFilePath())
+ continue;
+ if (item->GetState() == content::DownloadItem::IN_PROGRESS)
+ return false;
+ }
+ return true;
+}
+
void DownloadManagerDelegateQt::savePackageDownloadCreated(content::DownloadItem *item)
{
OnDownloadUpdated(item);
diff --git a/src/core/download_manager_delegate_qt.h b/src/core/download_manager_delegate_qt.h
index df43211e..7563d5d3 100644
--- a/src/core/download_manager_delegate_qt.h
+++ b/src/core/download_manager_delegate_qt.h
@@ -81,6 +81,8 @@ public:
const base::FilePath::StringType &default_extension,
bool can_save_as_complete,
const content::SavePackagePathPickedCallback &callback) override;
+ bool IsMostRecentDownloadItemAtFilePath(content::DownloadItem* download) override;
+
void cancelDownload(quint32 downloadId);
void pauseDownload(quint32 downloadId);
--
2.14.3