diff options
| author | Eduard Braun <eduard.braun2@gmx.de> | 2017-02-13 23:42:11 +0000 |
|---|---|---|
| committer | Eduard Braun <eduard.braun2@gmx.de> | 2017-02-13 23:42:11 +0000 |
| commit | 24d66b5173963dcb69545614449de91da5397db6 (patch) | |
| tree | 2af56ea35b6224d3d205f53727740af638da0e16 | |
| parent | Extensions: Fix potential security issue with "description" parameters. (diff) | |
| download | inkscape-24d66b5173963dcb69545614449de91da5397db6.tar.gz inkscape-24d66b5173963dcb69545614449de91da5397db6.zip | |
Extensions: Add 'appearance="url"' to desccription parameters.
It allows to create and add a clickable plain text link to extensions
The description parameter's text is escaped and converted to a URL as-is preventing potential security issues
The Scour extension shows a first example implementation
(bzr r15519)
| -rw-r--r-- | share/extensions/scour.inx | 6 | ||||
| -rw-r--r-- | src/extension/param/description.cpp | 3 | ||||
| -rw-r--r-- | src/extension/param/description.h | 2 | ||||
| -rw-r--r-- | src/extension/param/parameter.cpp | 12 |
4 files changed, 15 insertions, 8 deletions
diff --git a/share/extensions/scour.inx b/share/extensions/scour.inx index e5a34188c..7d7555664 100644 --- a/share/extensions/scour.inx +++ b/share/extensions/scour.inx @@ -95,10 +95,10 @@ <page name="About" _gui-text="About"> <param name="spacer" type="description"> </param> <_param name="about_name_desc" type="description">Optimized SVG Output is provided by</_param> - <param name="about_name" type="description" appearance="header"> Scour - An SVG Scrubber</param> + <param name="about_name" type="description" appearance="header" indent="1">Scour - An SVG Scrubber</param> <param name="spacer" type="description"> </param> <_param name="about_link_desc" type="description">For details please refer to</_param> - <param name="about_link" type="description"> https://github.com/scour-project/scour</param> + <param name="about_link" type="description" appearance="url" indent="1">https://github.com/scour-project/scour</param> <param name="spacer" type="description"> </param> <param name="spacer" type="description"> </param> <param name="spacer" type="description"> </param> @@ -106,7 +106,7 @@ <param name="about_version" type="description">Scour 0.31+</param> <param name="scour-version" type="string" gui-hidden="true">0.31</param> <!-- this parameter is checked programatically in the extension to show a warning --> <param _gui-text="Show warnings for older versions of Scour" - name="scour-version-warn-old" type="boolean" indent="1">true</param> + name="scour-version-warn-old" type="boolean">true</param> </page> </param> <output> diff --git a/src/extension/param/description.cpp b/src/extension/param/description.cpp index 3d970b204..7cf818280 100644 --- a/src/extension/param/description.cpp +++ b/src/extension/param/description.cpp @@ -80,6 +80,9 @@ ParamDescription::get_widget (SPDocument * /*doc*/, Inkscape::XML::Node * /*node label->set_markup(Glib::ustring("<b>") + Glib::Markup::escape_text(newguitext) + Glib::ustring("</b>")); label->set_margin_top(5); label->set_margin_bottom(5); + } else if (_mode == URL) { + Glib::ustring escaped_url = Glib::Markup::escape_text(newguitext); + label->set_markup(Glib::ustring::compose("<a href='%1'>%1</a>", escaped_url)); } else { label->set_text(newguitext); } diff --git a/src/extension/param/description.h b/src/extension/param/description.h index aa3c3a798..c6c5f4013 100644 --- a/src/extension/param/description.h +++ b/src/extension/param/description.h @@ -27,7 +27,7 @@ namespace Extension { class ParamDescription : public Parameter { public: enum AppearanceMode { - DESC, HEADER + DESC, HEADER, URL }; ParamDescription(const gchar * name, const gchar * guitext, diff --git a/src/extension/param/parameter.cpp b/src/extension/param/parameter.cpp index 9fbe662f7..0eb491078 100644 --- a/src/extension/param/parameter.cpp +++ b/src/extension/param/parameter.cpp @@ -135,11 +135,15 @@ Parameter *Parameter::make(Inkscape::XML::Node *in_repr, Inkscape::Extension::Ex ps->setMaxLength(atoi(max_length)); } } else if (!strcmp(type, "description")) { - if (appearance && !strcmp(appearance, "header")) { - param = new ParamDescription(name, guitext, desc, scope, gui_hidden, gui_tip, indent, in_ext, in_repr, ParamDescription::HEADER); - } else { - param = new ParamDescription(name, guitext, desc, scope, gui_hidden, gui_tip, indent, in_ext, in_repr, ParamDescription::DESC); + ParamDescription::AppearanceMode appearance_mode = ParamDescription::DESC; + if (appearance) { + if (!strcmp(appearance, "header")) { + appearance_mode = ParamDescription::HEADER; + } else if (!strcmp(appearance, "url")) { + appearance_mode = ParamDescription::URL; + } } + param = new ParamDescription(name, guitext, desc, scope, gui_hidden, gui_tip, indent, in_ext, in_repr, appearance_mode); } else if (!strcmp(type, "enum")) { param = new ParamComboBox(name, guitext, desc, scope, gui_hidden, gui_tip, indent, in_ext, in_repr); } else if (!strcmp(type, "notebook")) { |
