From b6d64f1f4338c6c8e0c3ed91983da6aa16024fe0 Mon Sep 17 00:00:00 2001 From: Christian Schneppe Date: Sat, 20 Oct 2018 22:01:04 +0200 Subject: Do not insert text shared over XMPP uri when already drafting message XMPP uris in the style of `xmpp:test@domain.tld?body=Something` can be used to directly share a message with a specific contact. Previously the text was always appended to the message currently in draft. The message was never send automatically. Essentially those links where treated like normal text share intents (for example when sharing a URL from the browser) but without the contact selection. There is a concern (CVE-2018-18467) that when this URI is invoked automatically and the user is currently drafting a long message to that particular contact the text could be inserted in the draft field (input box) without the user noticing. To circumvent that the text shared over XMPP uris that contain a particular contact is now appended only if the draft box is currently empty. Sharing text normally (**with** manual contact selection) is still treated the same; meaning the shared text will be appended to the current draft. This is intended behaviour to make the 'Hey I have this cool link here;' *open browser*, *share link* - secenario work. --- src/main/res/values/strings.xml | 1 + 1 file changed, 1 insertion(+) (limited to 'src/main/res/values') diff --git a/src/main/res/values/strings.xml b/src/main/res/values/strings.xml index 0016bb5d5..34c227331 100644 --- a/src/main/res/values/strings.xml +++ b/src/main/res/values/strings.xml @@ -834,5 +834,6 @@ Are you sure you want to delete this file?\n\nWarning: This will not delete copies of this file that are stored on other devices or servers. cancelled Remote server timeout + You are already drafting a message. -- cgit v1.2.3