Git commit 8676cdc84461b568fa6f18a06abc31242ba3becd by David Edmundson. Committed on 06/03/2013 at 22:42. Pushed by davidedmundson into branch 'master'. Review comments M +6 -7 filters/bugzilla/bugzilla-filter.cpp M +1 -1 filters/bugzilla/ktptextui_message_filter_bugzilla.desktop.c= make http://commits.kde.org/telepathy-text-ui/8676cdc84461b568fa6f18a06abc31242b= a3becd diff --git a/filters/bugzilla/bugzilla-filter.cpp b/filters/bugzilla/bugzil= la-filter.cpp index cfa4276..9ea9a37 100644 --- a/filters/bugzilla/bugzilla-filter.cpp +++ b/filters/bugzilla/bugzilla-filter.cpp @@ -31,11 +31,11 @@ class BugzillaFilter::Private { public: Private() { - filterId =3D 0; + requestCounter =3D 0; } = QRegExp bugText; - int filterId; + int requestCounter; QStringList bugzillaHosts; }; = @@ -62,9 +62,10 @@ BugzillaFilter::~BugzillaFilter() delete d; } = -void BugzillaFilter::addBugDescription(KTp::Message &message, const KUrl &= baseUrl) { - QString bugRequestId((QLatin1String("bug_") + QString::number(d->filte= rId))); - d->filterId++; +void BugzillaFilter::addBugDescription(KTp::Message &message, const KUrl &= baseUrl) +{ + QString bugRequestId((QLatin1String("bug_") + QString::number(d->reque= stCounter))); + d->requestCounter++; = KUrl request; request.setHost(baseUrl.host()); @@ -112,8 +113,6 @@ void BugzillaFilter::filterMessage(KTp::Message &messag= e, const KTp::MessageCont = if (url.fileName() =3D=3D QLatin1String("show_bug.cgi")) { //a bug= zilla of some sort = - //add a check on the hostname against a whitelist. - //as we have to use jsonp to get round making a cross-domain h= ttp request, a malicious website //could pretend to be bugzilla and return arbitrary data that = we cannot sanitise, filling the text-ui //then someone could send a link potentially executing random = JS. diff --git a/filters/bugzilla/ktptextui_message_filter_bugzilla.desktop.cma= ke b/filters/bugzilla/ktptextui_message_filter_bugzilla.desktop.cmake index 403ef20..2a25417 100644 --- a/filters/bugzilla/ktptextui_message_filter_bugzilla.desktop.cmake +++ b/filters/bugzilla/ktptextui_message_filter_bugzilla.desktop.cmake @@ -10,6 +10,6 @@ X-KDE-PluginInfo-Email=3Dkde-telepathy@kde.org X-KDE-PluginInfo-Name=3Dbugzilla X-KDE-PluginInfo-Version=3D@KTP_TEXT_UI_VERSION@ X-KDE-PluginInfo-Website=3Dhttp://community.kde.org/KTp -X-KDE-PluginInfo-License=3DGPL +X-KDE-PluginInfo-License=3DLGPL X-KDE-PluginInfo-EnabledByDefault=3Dtrue X-KTp-PluginInfo-Version=3D@KTP_MESSAGE_FILTER_FRAMEWORK_VERSION@