From b8f46a1ec3e6915d83803e5014e8d7676fdb79f8 Mon Sep 17 00:00:00 2001
From: Eric Hameleers <alien@slackware.com>
Date: Sun, 9 Dec 2018 15:39:22 +0100
Subject: KDE messagelib: apply security patch

CVE-2018-19516: HTML email can open browser window automatically.
---
 kde/patch/messagelib.patch                         |  4 ++++
 .../messagelib/messagelib_CVE-2018-19516.patch     | 28 ++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 kde/patch/messagelib.patch
 create mode 100644 kde/patch/messagelib/messagelib_CVE-2018-19516.patch

diff --git a/kde/patch/messagelib.patch b/kde/patch/messagelib.patch
new file mode 100644
index 0000000..982de5c
--- /dev/null
+++ b/kde/patch/messagelib.patch
@@ -0,0 +1,4 @@
+# CVE-2018-19516: HTML email can open browser window automatically.
+# Fixed in messagelib of KDE Applications 18.12.0.
+cat $CWD/patch/messagelib/messagelib_CVE-2018-19516.patch | patch -p1 --verbose || { touch ${SLACK_KDE_BUILD_DIR}/${PKGNAME}.failed ; continue ; }
+
diff --git a/kde/patch/messagelib/messagelib_CVE-2018-19516.patch b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch
new file mode 100644
index 0000000..fc44974
--- /dev/null
+++ b/kde/patch/messagelib/messagelib_CVE-2018-19516.patch
@@ -0,0 +1,28 @@
+From 34765909cdf8e55402a8567b48fb288839c61612 Mon Sep 17 00:00:00 2001
+From: Laurent Montel <montel@kde.org>
+Date: Fri, 23 Nov 2018 07:37:02 +0100
+Subject: Exclude Refresh from MetaData (Not necessary)
+
+---
+ messageviewer/src/messagepartthemes/default/defaultrenderer.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
+index 15ffe44..07de293 100644
+--- a/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
++++ b/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp
+@@ -308,6 +308,11 @@ QString processHtml(const QString &htmlSource, QString &extraHead)
+             return htmlSource;
+         }
+         extraHead = s.mid(startIndex + 6, endIndex - startIndex - 6);
++        //Don't authorize to refresh content.
++        if (s.contains(QStringLiteral("http-equiv=\"REFRESH\""), Qt::CaseInsensitive)) {
++            extraHead.clear();
++        }
++
+         s = s.mid(endIndex + 7).trimmed();
+     }
+ 
+-- 
+cgit v0.11.2
+
-- 
cgit v1.2.3