summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-05-24assume IFrame script/macro support isn't neededdistro/collabora/cp-6.4Caolán McNamara
seems undocumented at least Change-Id: I316e4f4f25ddb7cf6b7bac4d856a721b987207a3 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151020 Tested-by: Jenkins Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152150 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com> Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
2023-05-24put floating frames under managed links controlCaolán McNamara
like we do for sections and ole objects that link to their content individual commits in trunk are: extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse no behaviour change intended Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341 Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825) use parent window as dialog parent it makes no odds, but is more convenient for upcoming modification Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342 Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99) adjust IFrameObject so it could reuse mxFrame for a reload of content Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343 Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206) query getUserAllowsLinkUpdate for the case of content in a floating frame similarly to how it works for the more common "normal" embedded objects Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7) add a route to get writer Floating Frame links under 'manage links' Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be) allow SvxOle2Shape::resetModifiedState to survive having no SdrObject Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c) create the FloatingFrameShape in a separate step to inserting it this is derived from the path taken by the AddShape(const OUString&) function for this case. No change in behavior is intended. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024) add a route to get calc Floating Frame links under 'manage links' much harder than writer because the organization and ordering of properties and object activation etc is different. This ended up ugly, but functions. We set FrameURL before AddShape, we have to do it again later because it gets cleared when the SdrOle2Obj is attached to the XShape. But we want FrameURL to exist when AddShape triggers SetPersistName which itself triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to know what URL will end up being used. So bodge this by setting FrameURL to the temp pre-SdrOle2Obj attached properties and we can smuggle it eventually into SdrOle2Obj::SetPersistName at the right point after PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called in order to inform the link manager that this is an IFrame that links to a URL Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> bc5333b137d2da089b3b701ff615c6ddf43063d0 7eec3132a23faafd9a2878215a0a117a67bc9bf2 83e38dfa2f84907c2de9680e91f779d34864a9ad f90ff71d6a96342574799312f764badaf97980eb ea059262c124e3f44249e49b4189732310d28156 d09ae0c65a55a37743ad7c184070fb8dd97d8a7f 67fc199fef9e67fa12ca7873f0fe12137aa16d8f Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152131 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com> Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
2023-05-24set Referer on loading IFramesCaolán McNamara
so tools, options, security, options, "block any links from document not..." applies to their contents. Change-Id: I04839aea6b07a4a76ac147a85045939ccd9c3c79 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150221 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150751 Reviewed-by: Stephan Bergmann <sbergman@redhat.com> (cherry picked from commit acff9ca0579333b45d10ae5f8cd48172f563dddd) (cherry picked from commit 04c8176fb40d2eb983aa0bd0a6ce65804d3f6ecd) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152094 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com> Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
2023-05-24revert apparent overwrite of UITest_sfx2_doc.mk with ExternalPackage_libffi.mkCaolán McNamara
sfx2/UITest_sfx2_doc.mk:12: *** gb_ExternalPackage_use_external_project: only one project allowed. Stop. in: commit d2715de5b0a3bd4b5eabe99d8cf1edf52ca5b65f Date: Tue Jul 14 23:35:57 2020 +0200 python3: update to 3.8.4 Change-Id: I6869376eebbfbb7509bb38df7a80a06eb032ee73 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152177 Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com> Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
2023-04-07lok: Hide file linking in sectioncp-6.4-68Szymon Kłos
this is followup for 6f56317 Change-Id: I87227b3e665a6d15378ee294556bcd2f95801e6b
2023-04-07Disallow linking files as Writer sections in OnlineAndras Timar
Change-Id: I9e4971c72db44ca8216ac468240dd52d46e0b680 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143225 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Henry Castro <hcastro@collabora.com>
2023-04-07Make encodeForXml accessible for other modulesSzymon Kłos
and share similar code Change-Id: I7729a46d40845893f577c273c1ab340f69ebb51b
2023-04-04Bumnp version to 6.4-68co-6.4-68Andras Timar
Change-Id: Ie53c64f8644a121d023c3a64bd975540c2dc38b9
2023-04-04Underflow assert also in already calculated pathEike Rathke
Change-Id: I7bd1c4960280a6526bb82e5b95c5253775df1e1a Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147937 Reviewed-by: Eike Rathke <erack@redhat.com> Tested-by: Jenkins Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147958 Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de> Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
2023-04-04libffi: build DLL on WindowsJan-Marek Glogowski
The build setup is rather horrible, with some minimal gcc MSVC wrapper. But the DLL is a prerequisite for the Python 3.8 build, which dropped the internal libffi. It's also possible to build it statically, but then you have to patch the Python 3 _ctypes msbuild properties. This also defaults to explicit --build and --host settings, even without a cross build, because the predicted name would otherwise differ (*-unknown-* instead of *-pc-*). Additionally a "make install" also fails... Change-Id: Ifb7dac840e23efffb9a5e342560aef9e11e0db79 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/98436 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit 883068462fe5bcbb01a8e14736fc06d0c3695c62)
2023-04-04xmlsec: fix OOXML signing with multiple certs, extend the testTomaž Vajngerl
Signing OOXML with 3 or more times didn't work as other ids ("idPackageObject", "idOfficeObject", ...) were not uniqe. This change makes those ids unique by appending the signature id. The signature ID is now generated for OOXML too, while previously it was a hardcoded string ("idPackageSignature"). The test for signing multiple OOXML was written before, but didn't catch the issues because it didn't assert the status of the document after loading it again. This is which is now fixed (and also added changed for the ODF test case). Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124571 Tested-by: Jenkins Reviewed-by: Tomaž Vajngerl <quikee@gmail.com> (cherry picked from commit f2e1e4ff085962a08a5d7738325b383c07afcbbd) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124598 Reviewed-by: Jan Holesovsky <kendy@collabora.com> Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> (cherry picked from commit 59c3242b75fdc6d44992919e56bc9a379c699374) Change-Id: Ifa20ea17498b117a4c57f6eddf82f8e83bc640bc
2023-04-04xmlsec: signing the document fails the 3rd time (invalid signature)Tomaž Vajngerl
Signing the document 3 or more times produces an invalid signature. The cause of this is that xmlsec is confused because we have 3 signatures, which all have the same SignedProperties with the ID "idSignedProperties", but it expect them to be unique. This issue is fixed by making the ID unique with adding the ID of the Signature to the SignedProperties ID, so this makes them unique inside the same Signature. Also UnsignedProperties have a unique ID usign the same approach, but they aren't referenced - luckily. Change-Id: I53c7249a82fc0623586548db9fa25bdc0e7c4101 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124278 Tested-by: Jenkins Reviewed-by: Tomaž Vajngerl <quikee@gmail.com> (cherry picked from commit fd5463343ab7f784070f1ab87a345eed20803d07) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124327 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> (cherry picked from commit b883bc9d8ca4a9c6037166b2eff09095aef145e0)
2023-04-04CVE-2022-26305 compare authors using ThumbprintCaolán McNamara
Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8)
2023-04-04Bump version to 6.4-67co-6.4-67Andras Timar
Change-Id: Ia4f9b7c064c4d25a380083e3a40b923e44e4296b
2023-04-04python: build fixAndras Timar
Change-Id: Ie94383632b8b90d3c6e4507484e11cc80acc72a2
2023-04-01Bump version to 6.4-66co-6.4-66Andras Timar
Change-Id: I5dfb8a7319631a033b2c836148bd73f94f4b8cc7
2023-04-01Revert "[cp] Enable MSP patching"Andras Timar
This reverts commit ae17170cf3edb45fd2e270e7be83d06b91df0d9e. Reason for revert: recent upgrades to OpenSSL and Python changed DLL file names, and that is not compatible with MSP patching. Change-Id: Iab962a1d6e391b92ee0934a5a6a75b0a483234ba
2023-04-01python3: upgrade to release 3.8.16Michael Stahl
Fixes CVE-2022-37454 and a few other ones that look less relevant including CVE-2022-45061 and CVE-2015-20107. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143849 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 05f55b3898407828bb24347be56247f58803f7bb) Change-Id: I10fd254f7f0801d47119234bb3436874e98d8c91
2023-04-01Python3: update to 3.8.15Taichi Haradaguchi
* Fixes CVE-2022-40674 * Removed 0001-3.6-bpo-17239-Disable-external-entities-in-SAX-parse.patch.1 as fixed upstream Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141691 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ea5843b67f1c2006aa1f68f2d00a991e1d463262) Change-Id: I8e71f9a6b013ca4c45bf8774b284be98eee71bab
2023-04-01external/python3: Silence UBSan errors with --with-pydebugStephan Bergmann
...that happen when building ExternalProject_python3 itself after 12142490cd43f8568ab29e0ddfa75b334d6d39d5 "Enable Python Py_DEBUG setting when built with --enable-dbgutil on Linux": For one, silence > Modules/posixmodule.c:14395:9: runtime error: left shift of 34 by 26 places cannot be represented in type 'int' > #0 in all_ins at workdir/UnpackedTarball/python3/./Modules/posixmodule.c:14395:9 where at least my kernel-headers-5.9.9-200.fc33.x86_64 /usr/include/linux/memfd.h has > #define MFD_HUGE_16GB HUGETLB_FLAG_ENCODE_16GB and /usr/include/asm-generic/hugetlb_encode.h has > #define HUGETLB_FLAG_ENCODE_16GB (34 << HUGETLB_FLAG_ENCODE_SHIFT) For another (and as predicted in 29d47d22c43e6adc1850b7db5880028dcd07d1b3 "Fix passing --disable-optimized into external/python3": "in a Linux UBsan build, making ExternalProject_python3 would have started to cause some 'applying zero offset to null pointer' failures, but which would have been easy to fix"), silence > Objects/listobject.c:551:24: runtime error: applying zero offset to null pointer > #0 in list_concat at workdir/UnpackedTarball/python3/Objects/listobject.c:551:24 Change-Id: I0523cd35e393000c8e67629a0522b2db1d8c16f0 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/106984 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com> (cherry picked from commit 1657639d5e405c6e1e988d51a1f267c378c74b53)
2023-04-01python3: upgrade to release 3.8.13Taichi Haradaguchi
Remove some code in external/python3/darwin.patch.0 as it was fixed upstream(https://bugs.python.org/issue45405). Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139493 Tested-by: Jenkins Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit c8fd50f9ec02a131fd4c99e80f7252b49015653a) Change-Id: Ie6bfb2456f96a63adbf0dbcb9c902dc56f1151ee
2023-04-01python3: update to 3.8.10Jan-Marek Glogowski
So we don't build 3.8.8rc1 anymore. I didn't look into 3.9. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/117757 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit c22fc8e1f60bb98a87d22e7ff9bd3290dbb9fe02) Change-Id: Ife7d898c913b9b164168b0ef23a055deea55815f
2023-04-01python3: upgrade to release 3.8.8rc1Michael Stahl
Fixes CVE-2021-3177 plus these less important ones: CVE-2021-23336 CVE-2020-27619 CVE-2020-26116 CVE-2019-20907 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111208 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit a0c8dc42335764d07c16a017c6b00486ec17ae53) Change-Id: Idbe072a9db1faf8363b4f7795b9fde71c26969f0
2023-04-01python3: update to 3.8.4Jan-Marek Glogowski
With all the prerequisites in place, LO can be updated to the current Python release. Interestingly I found that Cygwin always seems to use LC_COLLATE=C, probably because the default collation rules are missing. Then there are the changes introduced in "PEP 587 -- Python Initialization Configuration", which appearingly have modified the DLL search path behaviour on Windows, so the OpenSLL DLLs aren't found anymore in the program directory. As a workaround, the OpenSLL and libffi DLLs are now (also) installed into the Python lib dir on Windows. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/98437 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit b4dfba947768834ffecc09056992019878711c8b) Change-Id: Ib82f7b77213da9c525f8c79a13d128d9eec9ca64
2023-04-01fix some more python 3.8 deprecation warningsNoel Grandin
Change-Id: I8bdbf05f1357aea83a3cdda2f06d63c7d04de8f9 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/94561 Tested-by: Jenkins Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit 0a3d414fb0ac27292320d99f802722a8a9670240)
2023-04-01fix python 3.8 deprecation warningsNoel Grandin
the logo changes were caused by > Support of nested sets and set operations as in Unicode Technical Standard > #18 might be added in the future. This would change the syntax, so to facilitate > this change a FutureWarning will be raised in ambiguous cases for the time being. > That includes sets starting with a literal '[' or containing literal character > sequences '--', '&&', '~~', and '||'. > To avoid a warning escape them with a backslash. Change-Id: I4d48be3df2eaadf03a9d1f5750c0c94b3abbf674 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/94191 Tested-by: Noel Grandin <noel.grandin@collabora.co.uk> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit b5fcdc3c07efb2c1175503b9c70e6d7336aa1452)
2023-04-01python3: fix build on Win 10Aron Budea
With Windows 11 SDK (10.0.22000.0). Error message is: fatal error RC1116: RC terminating after preprocessor errors https://bugs.python.org/issue45220 Applied fixing patches to 3.8. Change-Id: I0860b05fd963ea81b493a4b9df7f39db86598dd0 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127395 Tested-by: Mike Kaganski <mike.kaganski@collabora.com> Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com> (cherry picked from commit fa9ab05d78bb398efa3c09148e9d6d717f6168d1) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/137245 Tested-by: Michael Weghorn <m.weghorn@posteo.de> Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
2023-04-01Fix Python deprecation warningsStephan Bergmann
I noticed these "DeprecationWarning: Using or importing the ABCs from 'collections' instead of from 'collections.abc' is deprecated since Python 3.3, and in 3.9 it will stop working" now when running tests with CPPUNITTRACE='gdb --args' on Fedora 32. Change-Id: If263dacb9df5c1fffd2be2418e13e69b96070c77 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103294 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com> (cherry picked from commit 4a899a5f8a72ea29a6919316afe3627de9f33e95) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131344 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
2023-03-25Bump version to 6.4-65co-6.4-65Andras Timar
Change-Id: Ida38dda000cbe1ad8294ac7b2262cc1a6d393efc
2023-03-25tdf#78427 sdext.pdfimport: No need to read a font file for the purpose of...Kevin Suo
...determining the bold/italic/underline etc. The purpose for reading a font file is that in case the font attributes determined by the xpdfimport process is not enough, then we use the lo core font classes which read in the font file and then determine whether it is bold, italic etc. However, while this works in some cases, it does not work in many cases when the font file was actually a subset and a toUnicode map is followed in the PDF, see tdf#78427. In addition, in case the information collected from the xpdfimport process is enough, there is no need to read the font file. This commit removes the read of font file part. Also, this commit uses gfxFont->getNameWithoutSubsetTag() to get the font name with the subset tags removed, thus simplified the code in wrapper.cxx while also improves performace as the remove of subset tags is only run when the font is a subset (the previous code did this for all the font names). Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118733 Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> Tested-by: Jenkins (cherry picked from commit da59686672fd2bc98f8cb28d5f04dc978b50ac13) restore compatibility with older popplers with poppler 20.09: /home/rene/LibreOffice/git/libreoffice-7-2/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx: In member function 'int pdfi::PDFOutDev::parseFont(long long int, GfxFont*, GfxState*) const': /home/rene/LibreOffice/git/libreoffice-7-2/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx:438:39: error: 'class GfxFont' has no member named 'getNameWithoutSubsetTag' https://www.google.com/search?q=getNameWithoutSubsetTag&oq=getNameWithoutSubsetTag&aqs=chrome..69i57.784j0j7&sourceid=chrome&ie=UTF-8 suggests it was added in 20.12 Change-Id: I4eacd2d740cb689ff9b3c6cab59376e01b1ba162 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118977 Tested-by: René Engelhard <rene@debian.org> Tested-by: Jenkins Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit 07087041610ca8351d764c838ae07fa58f3bdf9e)
2023-03-25Bump version to 6.4-64co-6.4-64Andras Timar
Change-Id: Iaf0e7714633ac0213ca035633f15cfc7b5cbc1c2
2023-03-25postgresql: upgrade to release 13.10Taichi Haradaguchi
Fixes CVE-2022-41862 Reference: https://www.postgresql.org/support/security/CVE-2022-41862/ Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147834 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit efff34d7bdccf210a5e878bd9bc4d35ec72b71ab) Change-Id: I6075838972fec1c091f3150b19c5da4dc80ad6d3
2023-03-25bzip2: upgrade to release 1.0.8Michael Stahl
Fixes CVE-2019-12900 Change-Id: If3fcfff78a61c60014ba6d96f1ee0c432ccc52a1 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124758 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 1289125532a029dc80e4ee3d0a49dca253f51888) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124762 Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7208197a4ac718411fa6e3b4c770fdec8c67557d)
2023-03-25libxml2: upgrade to release 2.10.3Michael Stahl
Fixes CVE-2022-40304 and CVE-2022-40303. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141448 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 39b5701976ff3d489c3212d6e2a116d6244c8ad1) Change-Id: I5be3fd20ccf57596808a26b742aca325ac16f29b
2023-03-25libxml2: upgrade to release 2.10.2Michael Stahl
Fixes CVE-2022-2309 Change-Id: I180218be275d3b6d38f8f74aa51c57e50d2734ee Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139911 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit d621a8839cebf96fe3ac374026f344f8e68bf011) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139954 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
2023-03-25libxml2: use xml2-config dummy for internal buildJan-Marek Glogowski
When building a static LO with --disable-dynloading on Linux, --without-system-libs failed for me. And it left me really puzzled: raptor configure failed and claimed it couldn't link libxml2. raptor's config.log showed missing math functions. xml2-config of LO's build is patched and it includes a -lm. The xml2-config in my chroot doesn't. But we explicitly pass the xml2-config for non-system-libxml2 build. Reading the configure from raptor didn't reveal a way, that it could somehow pick up the xml2-config from the chroot, but that code is autoconf-complex... When running "sh -x configure", it turned out the configure script actually picks up the LIBXML_* flags from the environment, which are set by LO's config_host.mk. These just add -lm for Android. So this adds a xml2-config.in "dummy", which overwrites the one from the libxml2 source and just echos LO's LIBXML_* values and it adds -lm for all DISABLE_DYNLOADING targets. Change-Id: Ia713cf80c8e7dc989cf23c224e7a0f7ea1210a87 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/116409 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit 8b9f8f0f9d38cc64f742fe5358fce88d0f82391a) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139965 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 5c044ae7a3246bddbd0513bd5ed3efef10cb1503)
2023-03-25harfbuzz: add patch for CVE-2022-33068Michael Stahl
Should be fixed in release 4.4.0 Change-Id: I9ff234f9687c7f57d9226df91b17ddb0bc083cca Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139952 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 424d2e86cc103336fb70cd8ef7aacde1ac2e28ef)
2023-03-25poppler: upgrade to release 22.09.0Michael Stahl
Fixes CVE-2022-38784 Add external/poppler/disable-freetype.patch.1 to get rid of some new code that unconditionally requires freetype, to avoid building that on WNT/MACOSX. Change-Id: I854d1865286b6fb4112cdf37898cda0203c52f2e Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139941 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 8fce9a0a41b1bbebd325fc9d98a79d8decd3950c) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139967 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit bdbb450ed0ded86fb50d6b19a2cce0f11ca74b07)
2023-03-25upgrade poppler to 22.01.0Caolán McNamara
and popppler-data to 0.4.11 Change-Id: Ibd8c28f36408a670b5853f1b266c6b8c36916a61 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/128398 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 9dbfda4cea569459e42203771754b902c1a09759) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139966 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Tested-by: Noel Grandin <noel.grandin@collabora.co.uk> Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit 486a1004982b4072b488e8c42a7e09afd8043c2e)
2023-03-25Fix build with Poppler 22.09.0Sam James
With Poppler 22.09.0, LO fails to build with: ``` /var/tmp/portage/app-office/libreoffice-7.3.5.2/work/libreoffice-7.3.5.2/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx:682:36: error: too many arguments to function call, expected single argument 'start', have 3 arguments state->getLineDash(&dashArray, &arrayLen, &startOffset); ~~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~ /usr/include/poppler/GfxState.h:1506:32: note: 'getLineDash' declared here const std::vector<double> &getLineDash(double *start) ^ 1 error generated. ``` Poppler changed the getLineDash interface: ``` - void getLineDash(double **dash, int *length, double *start) + const std::vector<double> &getLineDash(double *start) ``` Signed-off-by: Sam James <sam@gentoo.org> Change-Id: I29e18f20d7650a7fcac1bc8ab4aaa04aaa2ab8fb Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139249 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit b7d63694985bbb1cf86eb71769feadb28ce68c17) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139835 (cherry picked from commit 89d2ecd6bc71fc6e581cff595b18ae67a13d8b11)
2023-03-25Update for Poppler 22.06Nathan Pratta Teodosio
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136261 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 0d0469b4302dfe95b016a6f04b145834b79d5ed3) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136319 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com> (cherry picked from commit 56c7e666ebf47d6cdf29adf85fc5de56246be86d) Follow-up for Poppler 22.06 update Change-Id: I8ee9f1a53cc4389e6a4d44e9765b478b5edfffd4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136342 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit ad1ffc62e40c2409b610dfff25a8483b1f2556ad) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136382 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com> (cherry picked from commit 71fb0151f985924af60c383331b214a5a27790a5)
2023-03-25poppler: upgrade to release 21.11.0Michael Stahl
The changelogs tend to mention "crash in malformed files" a lot. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125034 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 03bc0f97205593547ddf1fc8d4fb396479bcab6d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124973 Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 22beb8f80985ea73e2c98d14480e53da81673c67) Change-Id: Iadc1d9cc23abd09a8fff58ba0cb7a7803236a542
2023-03-25upgrade Expat to 2.5.0Taichi Haradaguchi
Fixes CVE-2022-43680 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142205 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 74eea44c685e108fab44c85ce81609091c7be1ec) Change-Id: I5bf8d1ab0ac352833c76a7edfc1d8eb78dd03e10
2023-03-25update expat to 2.4.9Taichi Haradaguchi
Fixes CVE-2022-40674 (https://github.com/libexpat/libexpat/blob/R_2_4_9/expat/Changes) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/140173 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 1bff2caff1bbb39fe431c455aeab1f0234200d8d) Change-Id: I459cf5f5de31e7cf5420d3df6b11893d5c4ca4dd
2023-03-25curl: upgrade to release 8.0.1Michael Stahl
Apparently 8.0.0 had a serious regression. Change-Id: Icc761f5e5e01b5d9bebecc13f7cba608f5834f54 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149212 Tested-by: Andras Timar <andras.timar@collabora.com> Reviewed-by: Andras Timar <andras.timar@collabora.com>
2023-03-25curl: upgrade to release 8.0.0Michael Stahl
Fixes CVE-2023-27535. Also hopefully fixes excessive storage consumption during build: o build: drop the use of XC_AMEND_DISTCLEAN [62] Change-Id: I8792e95bc7634ee496488e80fec5a1310b24a31c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149153 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149211 Tested-by: Andras Timar <andras.timar@collabora.com> Reviewed-by: Andras Timar <andras.timar@collabora.com>
2023-03-25curl: upgrade to release 7.88.1Taichi Haradaguchi
Fixes CVE-2023-23916, 2 CVEs that probably don't affect LO. Reference: https://curl.se/docs/security.html Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147977 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 6074d16b8c631e679a67364837d4ca9799731152) Change-Id: If9b3fc7c5ce66bfe1027caff39ea2c1cf55df7ad
2023-03-25curl: upgrade to release 7.87.0Taichi Haradaguchi
Fixes CVE-2022-43551 and CVE-2022-43552. https://curl.se/docs/CVE-2022-43551.html https://curl.se/docs/CVE-2022-43552.html Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 181806115a694ade32c7bba1abd9aa931b1a93b9) Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5
2023-03-25curl: upgrade to release 7.86.0Michael Stahl
Fixes CVE-2022-32221 which could affect libcmis, CVE-2022-42915, and 2 more CVEs that probably don't affect LO. * remove --without-ssl: On the one hand, on GNU/Linux this now results in: configure: error: --without-ssl has been set together with an explicit option to use an ssl library On the other hand, using the more obvious --without-openssl yields a link failure on Android on the nss check in configure: configure:28220: checking for SSL_VersionRangeSet in -lnss /home/cl/Android/Sdk/ndk/20.1.5948944/toolchains/llvm/prebuilt/linux-x86_64/bin/../lib/gcc/aarch64-linux-android/4.9.x/../../../../aarch64-linux-android/bin/ld: warning: liblog.so, needed by /home/cl/rpmbuild/BUILD/lo-android2/workdir/UnpackedTarball/nss/dist/out/lib/libnss3.so, not found (try using -rpath or -rpath-link) /home/cl/rpmbuild/BUILD/lo-android2/workdir/UnpackedTarball/nss/dist/out/lib/libnspr4.so: undefined reference to `__android_log_write' /home/cl/rpmbuild/BUILD/lo-android2/workdir/UnpackedTarball/nss/dist/out/lib/libnspr4.so: undefined reference to `__android_log_assert' ... so add the -llog for android in curl-nss.patch.1 Change-Id: I3931a1eec2d681c2ce0e5695039492772e9fcc81 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141866 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit a76a88203d8508f38b10d9bbb94c3bba2485fcaf)
2023-03-25curl: upgrade to release 7.85.0Taichi Haradaguchi
Fixes CVE-2022-35252 Change-Id: I549240f6ae31ae94f925422517cd03ef2e3b5732 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/140411 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 31a8de10e8f60d79d6eb588a049567b89a48f0b1)
generated by cgit (git 2.34.1) at 2024-04-20 03:42:51 +0000