user/kauth: Bump to 5.65.0, remove upstream CVE patch

2 files changed, 5 insertions, 75 deletions

diff --git a/user/kauth/APKBUILD b/user/kauth/APKBUILD
index 351d00f50..d21d86685 100644
--- a/user/kauth/APKBUILD
+++ b/user/kauth/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: A. Wilcox <awilfox@adelielinux.org>
 # Maintainer: A. Wilcox <awilfox@adelielinux.org>
 pkgname=kauth
-pkgver=5.54.0
-pkgrel=1
+pkgver=5.65.0
+pkgrel=0
 pkgdesc="Framework for allowing software to gain temporary privileges"
 url="https://www.kde.org/"
 arch="all"
@@ -11,8 +11,7 @@ depends=""
 depends_dev="polkit-qt-1-dev qt5-qtbase-dev kcoreaddons-dev"
 makedepends="$depends_dev cmake extra-cmake-modules qt5-qttools-dev doxygen"
 subpackages="$pkgname-dev $pkgname-doc $pkgname-lang"
-source="https://download.kde.org/stable/frameworks/${pkgver%.*}/kauth-$pkgver.tar.xz
-	CVE-2019-7443.patch"
+source="https://download.kde.org/stable/frameworks/${pkgver%.*}/kauth-$pkgver.tar.xz"
 
 # secfixes:
 #   5.54.0-r1:
@@ -30,7 +29,7 @@ build() {
 		-DCMAKE_CXX_FLAGS="$CXXFLAGS" \
 		-DCMAKE_C_FLAGS="$CFLAGS" \
 		-DBUILD_QCH:BOOL=ON \
-		${CMAKE_CROSSOPTS}
+		${CMAKE_CROSSOPTS} .
 	make
 }
 
@@ -42,5 +41,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-sha512sums="f75c6f019d708409817a5b64d88033326a7d627cdee00e61280043d5cd8f65731f08d48405f50c7240f18670b25abfeea4b2af5966ebb2ee7e0f56669b5551c2  kauth-5.54.0.tar.xz
-9cb0e37eedb5cee82c5e6d1b316f92f014c8850c9274a8d0c728f306ceabc35cbbec81b0057ebaf904bd48f3e07d6f83d91b0ef12602a0c1ba66b39a04bb45e4  CVE-2019-7443.patch"
+sha512sums="5de70c1ddf73ab7def59d057d596acc657ee54e11a7def29b37e44f8458f4c65422afb8613efd94bad83974eea428e393fe9c2d5aa8482ab410ea83cf7be7a6e  kauth-5.65.0.tar.xz"
diff --git a/user/kauth/CVE-2019-7443.patch b/user/kauth/CVE-2019-7443.patch
deleted file mode 100644
index 5b11cd8f5..000000000
--- a/user/kauth/CVE-2019-7443.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From fc70fb0161c1b9144d26389434d34dd135cd3f4a Mon Sep 17 00:00:00 2001
-From: Albert Astals Cid <aacid@kde.org>
-Date: Sat, 2 Feb 2019 14:35:25 +0100
-Subject: Remove support for passing gui QVariants to KAuth helpers
-
-Supporting gui variants is very dangerous since they can end up triggering
-image loading plugins which are one of the biggest vectors for crashes, which
-for very smart people mean possible code execution, which is very dangerous
-in code that is executed as root.
-
-We've checked all the KAuth helpers inside KDE git and none seems to be using
-gui variants, so we're not actually limiting anything that people wanted to do.
-
-Reviewed by security@kde.org and Aleix Pol
-
-Issue reported by Fabian Vogt
----
- src/backends/dbus/DBusHelperProxy.cpp | 9 +++++++++
- src/kauthaction.h                     | 2 ++
- 2 files changed, 11 insertions(+)
-
-diff --git a/src/backends/dbus/DBusHelperProxy.cpp b/src/backends/dbus/DBusHelperProxy.cpp
-index 10c14c6..8f0d336 100644
---- a/src/backends/dbus/DBusHelperProxy.cpp
-+++ b/src/backends/dbus/DBusHelperProxy.cpp
-@@ -31,6 +31,8 @@
- #include "kf5authadaptor.h"
- #include "kauthdebug.h"
- 
-+extern Q_CORE_EXPORT const QMetaTypeInterface *qMetaTypeGuiHelper;
-+
- namespace KAuth
- {
- 
-@@ -229,10 +231,17 @@ QByteArray DBusHelperProxy::performAction(const QString &action, const QByteArra
-         return ActionReply::HelperBusyReply().serialized();
-     }
- 
-+    // Make sure we don't try restoring gui variants, in particular QImage/QPixmap/QIcon are super dangerous
-+    // since they end up calling the image loaders and thus are a vector for crashing → executing code
-+    auto origMetaTypeGuiHelper = qMetaTypeGuiHelper;
-+    qMetaTypeGuiHelper = nullptr;
-+
-     QVariantMap args;
-     QDataStream s(&arguments, QIODevice::ReadOnly);
-     s >> args;
- 
-+    qMetaTypeGuiHelper = origMetaTypeGuiHelper;
-+
-     m_currentAction = action;
-     emit remoteSignal(ActionStarted, action, QByteArray());
-     QEventLoop e;
-diff --git a/src/kauthaction.h b/src/kauthaction.h
-index c67a70a..01f3ba1 100644
---- a/src/kauthaction.h
-+++ b/src/kauthaction.h
-@@ -298,6 +298,8 @@ public:
-      * This method sets the variant map that the application
-      * can use to pass arbitrary data to the helper when executing the action.
-      *
-+     * Only non-gui variants are supported.
-+     *
-      * @param arguments The new arguments map
-      */
-     void setArguments(const QVariantMap &arguments);
--- 
-cgit v1.1
-