|
Ugh, this is just amazing in all the bad ways.
Thanks Diap for pointing me at this. I can certainly backport the relevant sigil/pageedit commits to my Arch package. But before I do so -- given the discussion that's happened here AFTER your PM, is this still something you'd recommend doing? If you're going to write a custom protocol very soon, is that something I should be waiting for instead?
(Javascript should be disabled by default, so users who enable it will not be walking into this security hole by accident. So it seems reasonable to make things work for most users. Maybe I could print a post_upgrade message warning that qt has broken the security hardening if you've enabled javascript, and it should only be enabled if you trust the book.)
|