Commit 1638db3f authored by David Edmundson's avatar David Edmundson

Prevent paste in screen locker

Summary:
KScreenlocker tries to clear the clipboard on load. However, klipper
also (by default) automatically keeps the last relevant item in the
clipboard. Whilst both parts independently work correctly, Plasma as a
whole does not.

This became a problem when we added the reveal password button as it is
a data leak.

Instead of clearing the clipboard this patch replaces it with a real
entry, but with a dummy mime value that is of no value to anyone,
especially a textfield.

BUG: 388049

Test Plan:
Reproduced issue
Made this patch
Tried pasting in session
Nothing happned
Logged in
Could paste

Reviewers: #plasma, mart

Reviewed By: mart

Subscribers: mart, graesslin, plasma-devel

Tags: #plasma

Differential Revision: https://phabricator.kde.org/D14924
parent c25251a7
......@@ -53,6 +53,7 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
#include <QtGui/QKeyEvent>
#include <qscreen.h>
#include <QThread>
#include <QMimeData>
#include <QQuickView>
#include <QQuickItem>
......@@ -400,8 +401,20 @@ void UnlockApp::markViewsAsVisible(KQuickAddons::QuickViewSharedEngine *view)
showProperty.write(true);
// random state update, actually rather required on init only
QMetaObject::invokeMethod(this, "getFocus", Qt::QueuedConnection);
QGuiApplication::clipboard()->clear();
QGuiApplication::clipboard()->clear(QClipboard::Selection);
auto mime1 = new QMimeData;
//Effectively we want to clear the clipboard
//however some clipboard managers (like klipper with it's default settings)
//will prevent an empty clipbard
//we need some non-empty non-text mimeData to replace the clipboard so we don't leak real data to a user pasting into the text field
//as the clipboard is cleared on close, klipper will then put the original text back when we exit
mime1->setData(QStringLiteral("x-kde-lockscreen"), QByteArrayLiteral("empty"));
//ownership is transferred
QGuiApplication::clipboard()->setMimeData(mime1, QClipboard::Clipboard);
auto mime2 = new QMimeData;
mime2->setData(QStringLiteral("x-kde-lockscreen"), QByteArrayLiteral("empty"));
QGuiApplication::clipboard()->setMimeData(mime2, QClipboard::Selection);
}
void UnlockApp::getFocus()
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment