diff options
| author | Herbert Dürr <hdu@apache.org> | 2014-07-10 09:11:07 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-07-10 14:04:10 +0100 |
| commit | d1fc47793c1efbe9ff5271656283211647dd0b33 (patch) | |
| tree | 6aa554016f63c67db402b88eecf81ae55dd668b7 /sfx2/source/appl/impldde.cxx | |
| parent | 13b68e24db26374ca17572de9abb429edeac32e9 (diff) | |
Related: #i125226# disallow absolute and relative paths for DDE servers
(cherry picked from commit 6b64ada6e3a902ac4b44fe49476514d49138d4d4)
Conflicts:
sfx2/source/appl/impldde.cxx
Change-Id: I127add375a127dbbd0eaf12a10884e2636f1a332
Diffstat (limited to 'sfx2/source/appl/impldde.cxx')
| -rw-r--r-- | sfx2/source/appl/impldde.cxx | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sfx2/source/appl/impldde.cxx b/sfx2/source/appl/impldde.cxx index 8a93a7eaebb3..7ec637a825ca 100644 --- a/sfx2/source/appl/impldde.cxx +++ b/sfx2/source/appl/impldde.cxx @@ -25,6 +25,7 @@ #include "impldde.hxx" +#include <comphelper/string.hxx> #include <vcl/svapp.hxx> #include <vcl/fixed.hxx> #include <vcl/edit.hxx> @@ -248,19 +249,20 @@ bool SvDDEObject::Connect( SvBaseLink * pSvLink ) // check the suitability of starting the DDE server const SvtSecurityOptions aSecOpts; bool bForbidden = (aSecOpts.GetMacroSecurityLevel() == eNEVER_EXECUTE); - bForbidden |= (bInWinExec != false); + bForbidden |= (comphelper::string::indexOfAny(sServer, L":./%\\") != -1); static const char* aBadServers[] = { "cmd", "rundll32" }; for (size_t i = 0; i < sizeof(aBadServers)/sizeof(*aBadServers); ++i) bForbidden |= sServer.equalsAscii(aBadServers[i]); // try to start the DDE server if it is not there already + bForbidden |= (bInWinExec != false); if( !bForbidden ) { OStringBuffer aCmdLine(OUStringToOString(sServer, RTL_TEXTENCODING_ASCII_US)); aCmdLine.append(".exe "); aCmdLine.append(OUStringToOString(sTopic, RTL_TEXTENCODING_ASCII_US)); - if( WinExec( aCmdLine.getStr(), SW_SHOWMINIMIZED ) < 32 ) + if( WinExec( aCmdLine.getStr(), SW_SHOWMINIMIZED ) < 32 ) // TODO: use CreateProcess() instead nError = DDELINK_ERROR_APP; else { |