summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-07-11CVE-2018-10895: Fix CSRF issues with qute://settings/set URLv1.2.xFlorian Bruhin
In ffc29ee043ae7336d9b9dcc029a05bf7a3f994e8 (part of v1.0.0), a qute://settings/set URL was added to change settings. Contrary to what I apparently believed at the time, it *is* possible for websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine prohibit such requests, other than the usual cross-origin rules). In other words, this means a website can e.g. have an `<img>` tag which loads a `qute://settings/set` URL, which then sets `editor.command` to a bash script. The result of that is arbitrary code execution. Fixes #4060 See #2332 (cherry picked from commit 43e58ac865ff862c2008c510fc5f7627e10b4660)
2018-03-14Update changelog from masterFlorian Bruhin
2018-03-14Swap Control/Meta back on macOSFlorian Bruhin
Fixes #3697 (cherry picked from commit fd9e7bed7fd9842eac22ed304a094a92cc953577) (cherry picked from commit 84c7c37e8eb61f7e3dddbbfc6dbbcfd3f5afeffd)
2018-03-14Disable test_software_rendering on macOSFlorian Bruhin
For some reason, macOS doesn't care about us disabling software rendering (cherry picked from commit d232b3ea57a7379c3776a0d65bd5b8fa4f29b42e)
2018-03-14Don't emit predicted_navigation for reloads at allFlorian Bruhin
When we reload a page because of a config change, we won't get another titleChanged signal (at least sometimes). Also, the predicted_navigation signal is worthless when reloading anyways, as we're going to load the same URL and not something different. Fixes #3718 (cherry picked from commit 0418a865c17c26720219e33a67c88410a6ac7181)
2018-03-14Add test for #3711Jay Kamat
(cherry picked from commit 35beff98a94213f725a0a568e4d2a81d2b43c926)
2018-03-14Fix hinting in frames on qt5.9 with input rangesJay Kamat
(cherry picked from commit a6e94cf30cdca42ab93ac7801d2f044248880d01)
2018-03-13Mark BaseKeyParser.handle as noqaFlorian Bruhin
This got fixed properly in master, but can stay like this in this branch.
2018-03-13Fall back to non-keypad keys without any keypad bindingsFlorian Bruhin
Fixes #3701 (cherry picked from commit b88ac51d25da043ca431b2cc12a353f34bce06f7)
2018-03-13Don't emit predicted_navigation with invalid URLsFlorian Bruhin
Fixes #3706 (cherry picked from commit 1c9598d2c00257ea82fda211f3e734bcc3e76524)
2018-03-12Fix lintFlorian Bruhin
(cherry picked from commit 8c5b7bcd0395f113383a730752b766636c50f776)
2018-03-12Normalize keys read from the configFlorian Bruhin
This makes sure the internal bindings.commands object only contains normalized key sequences. Fixes #3699 (cherry picked from commit 994181212734cacdfa6e4d7cb35402881282bf4f)
2018-03-12Make from_obj() work for List/Dict configtypesFlorian Bruhin
We can't easily make it work for ListOrValue as we don't know which of both we get at this point. (cherry picked from commit 990c0707f4533bab35be1c24dd7dca759fc8fdcd)
2018-03-12tests: Add a yaml_config_stub fixtureFlorian Bruhin
(cherry picked from commit c03ef10d54e2129d309ea5d6c40471efa105764e)
2018-03-11build_release: Wait before detaching volumeFlorian Bruhin
This hopefully helps with detaching it properly. (cherry picked from commit 27c2650245687cb8e50a7a2984ab5ad76dade053)
2018-03-11Force PyQt 5.10.0 with "tox -e mkvenv-pypi"Florian Bruhin
Fixes #3662 (cherry picked from commit 30ab1d02180eb58ed538e7b3c9528a1f5c0a90c1)
2018-03-11Mark another GreaseMonkey test as flakyFlorian Bruhin
See #3238 (cherry picked from commit f0a649e101d7a6563d9ce60d474f6f7ea3b3f9a9)
2018-03-11Fix keybinding cheatsheet URLs in quickstart.asciidocFlorian Bruhin
The URLs and the patching were changed in 96e8151ccef1ee4e497106678432e3025f39d6d2 but not in quickstart.asciidoc. (cherry picked from commit 75ab8f077d8de8da17b681ca02c06f24516714b1)
2018-03-11Handle ImportError in version.opengl_vendorFlorian Bruhin
Fixes #3698 (cherry picked from commit d9f7d401c612706f08600225dd8ee3dbcb428b46)
2018-03-09Release v1.2.0v1.2.0Florian Bruhin
2018-03-09Fix lintFlorian Bruhin
2018-03-09Make sure keys with modifiers get handled as specialFlorian Bruhin
2018-03-09Clear key chains when a special key is pressed in hint modeFlorian Bruhin
When we press "s<Escape>", we don't want <Escape> to be handled as part of a key chain.
2018-03-09Add first tests for HintKeyParserFlorian Bruhin
2018-03-09Fix lintFlorian Bruhin
2018-03-08keyinput: Merge keyparser into modeparsersjakanakae-envangel
2018-03-08Add compiled=False to version checksFlorian Bruhin
2018-03-08Don't double HTML escape JavaScript messagesFlorian Bruhin
See https://bugreports.qt.io/browse/QTBUG-66104
2018-03-08Remove old commentsFlorian Bruhin
See #3687 [ci skip]
2018-03-08Add security entry FAQFlorian Bruhin
Fixes #3686
2018-03-08travis: Test Python 3.5 with Qt 5.7.1Florian Bruhin
Might run more stable, and makes more sense anyways.
2018-03-08Add Chromium versions to _chromium_version commentFlorian Bruhin
2018-03-08Fix handling of empty bindings without breaking :unbindFlorian Bruhin
1899e313fd4f0a35cb71390053ebbcb8df451537 as a fix for #3631 broke :unbind, as the config system treats None and '' equally. Instead, allow None/'' again, but just handle it as "no binding".
2018-03-08Disallow binding to an empty commandFlorian Bruhin
This was introduced (most likely accidentally) in 9cbacf3264fdfcbf491a48811de151779f0ebebc. Fixes #3631
2018-03-08Fix test/lintFlorian Bruhin
2018-03-07Add predicted_navigation for reload()Florian Bruhin
This should avoid a double-reload for 'tsh' etc.
2018-03-07Add an input.insert_mode.auto_enter settingFlorian Bruhin
Closes #3143
2018-03-07Show the keystring correctly when entering a countFlorian Bruhin
2018-03-07Allow to bind numbers in keybindingsFlorian Bruhin
This mostly reverts 4ef5db1bc4b5205812714a57d29daa59224afe8b for #1966, but fixes #3684 by allowing numbers to be bound again. If the user wants to bind numbers instead of using them for a count, why not let them.
2018-03-07Make bindings.default only settable in autoconfig.ymlFlorian Bruhin
Fixes #3131
2018-03-06Fix lintFlorian Bruhin
2018-03-06Allow empty vlaue for bindings.key_mappingsFlorian Bruhin
2018-03-06Apply key_mappings to KeySequences correctlyFlorian Bruhin
Fixes #3678
2018-03-06Update config tests for pattern changesFlorian Bruhin
2018-03-06Edit changelogFlorian Bruhin
2018-03-06Improve error message for QtWebEngine inspectorFlorian Bruhin
2018-03-06Require a reload for more settingsFlorian Bruhin
2018-03-06Add input.spatial_navigation to needs_reloadFlorian Bruhin
See #3648
2018-03-06Also remove Qt 5.8 from TravisFlorian Bruhin
2018-03-06Remove Qt 5.8 support and testsFlorian Bruhin
With QtWebKit it's probably okay to still use it (*cough* Hyperbola GNU/Linux-libre^tm *cough*), and only blacklisting it with QtWebEngine would be quite some effort. Fixes #3608
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion