| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
| |
When starting spicec with --controller, SPICE_XPI_SOCKET environment
variable must be defined so spicec and the controller can be connected.
|
| |
|
|
|
| |
text refered a substr of item_dup and was used after free(item_dup).
no need to strdup, we can destroy the resource string.
|
| |
|
|
|
|
| |
We are making all text send over the controller socket utf-8, rather then
having somethings as 8 bit (hostname) and others (title, menu) unicode16,
this patch completes this change by converting the menu handling.
|
| |
|
|
|
|
|
| |
The activex browser plugin is sending unicode16 text, where as the
xpi one is sending utf8 text. After discussing this on irc we've decided
that utf8 is what we want to use. So the client (this patch), and the
activex will be changed to expect resp. send utf8 text as the title.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The socket name used to communicate between the xpi browser plugin and the
spicec was predictable allowing a non priviliged user on the same system
to create the socket before spicec does and thus intercept the messages from
the xpi to the client, including login credentials. This security vulnerability
has been registred with mitre as CVE-2010-2792:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2792
This patch changes the controller code to instead read the socket name
from an environment variable which gets set by the xpi before executing
the spicec, making the socketname private between the client and the xpi.
Note that this means that the controller will only work with an xpi which
has matching changes, the changes are present in the latest version of the
xpi as available as update for / with RHEL-5.5 and RHEL-6.0 .
|
|
|
Spice client controller enables external control (e.g., by XPI or ActiveX) of
the client functionality.
The controller protocol enables setting parameters (host, port, sport, pwd,
secure channels, disabled channels, title, menus, hotkeys etc.), connecting
the server, showing and hiding the client etc.
The controller is based on the cross-platform named pipe.
|
