diff options
| author | Michael Stahl <mstahl@redhat.com> | 2015-02-11 14:42:51 +0100 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2015-02-11 15:12:07 +0100 |
| commit | 6aea0829f8650922f5422f2f2b2e432968d11b9b (patch) | |
| tree | 5879b0297b0c73bd86c67ec18fdb4c939bb23770 | |
| parent | e81888278d953f6b283a489f28c36210c15f093e (diff) | |
tdf#87303: svtools: relax the security a bit for embedded objects
CVE-2014-3575 was about updating linked objects, there is no security
issue with embedded objects so always allow updating the preview image
for them.
(regression from d005acae3aa315921f2c331612131626c470bd22)
Change-Id: I6e4d013ddf4fbe08c5968c680bbe143dd0473a4b
| -rw-r--r-- | svtools/source/misc/embedhlp.cxx | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/svtools/source/misc/embedhlp.cxx b/svtools/source/misc/embedhlp.cxx index eb2aea48fd50..5785701f0e89 100644 --- a/svtools/source/misc/embedhlp.cxx +++ b/svtools/source/misc/embedhlp.cxx @@ -44,6 +44,7 @@ #include <com/sun/star/embed/NoVisualAreaSizeException.hpp> #include <com/sun/star/embed/XEmbeddedObject.hpp> #include <com/sun/star/embed/XStateChangeListener.hpp> +#include <com/sun/star/embed/XLinkageSupport.hpp> #include <com/sun/star/datatransfer/XTransferable.hpp> #include <com/sun/star/chart2/XDefaultSizeTransmitter.hpp> #include <cppuhelper/implbase4.hxx> @@ -604,15 +605,21 @@ SvStream* EmbeddedObjectRef::GetGraphicStream( bool bUpdate ) const if ( !xStream.is() ) { SAL_INFO( "svtools.misc", "getting stream from object" ); - bool bUserAllowsLinkUpdate(true); + bool bUpdateAllowed(true); const comphelper::EmbeddedObjectContainer* pContainer = GetContainer(); if(pContainer) { - bUserAllowsLinkUpdate = pContainer->getUserAllowsLinkUpdate(); + uno::Reference<embed::XLinkageSupport> const xLinkage( + mpImpl->mxObj, uno::UNO_QUERY); + if (xLinkage.is() && xLinkage->isLink()) + { + bUpdateAllowed = pContainer->getUserAllowsLinkUpdate(); + + } } - if(bUserAllowsLinkUpdate) + if (bUpdateAllowed) { // update wanted or no stream in container storage available xStream = GetGraphicReplacementStream(mpImpl->nViewAspect, mpImpl->mxObj, &mpImpl->aMediaType); |