X2Go Bug report logs - #258
SECURITY: x2goclient allows clipboard sniffing

Full log

Message #105 received at control@bugs.x2go.org (full text, mbox, reply):

Received: (at control) by bugs.x2go.org; 21 Oct 2014 11:27:39 +0000
From x2go@ymir.das-netzwerkteam.de  Tue Oct 21 13:26:09 2014
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_RELAYS,
	URIBL_BLOCKED autolearn=unavailable version=3.3.2
Received: by ymir.das-netzwerkteam.de (Postfix, from userid 1005)
	id 786DD3D45B; Tue, 21 Oct 2014 13:26:09 +0200 (CEST)
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: 258-submitter@bugs.x2go.org
Cc: control@bugs.x2go.org, 258@bugs.x2go.org
Subject: X2Go issue (in src:x2goclient) has been marked as closed
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Message-Id: <20141021112609.786DD3D45B@ymir.das-netzwerkteam.de>
Date: Tue, 21 Oct 2014 13:26:09 +0200 (CEST)

close #258
thanks

Hello,

we are very hopeful that X2Go issue #258 reported by you
has been resolved in the new release (4.0.3.0) of the
X2Go source project »src:x2goclient«.

You can view the complete changelog entry of src:x2goclient (4.0.3.0)
below, and you can use the following link to view all the code changes
between this and the last release of src:x2goclient.

    http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=04ed56d4162f000b093bea13aa2582c2de718144;hp=85bf0c6e7539910fff779689528009a897cdceb4

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:x2goclient.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:x2goclient
Version: 4.0.3.0-0x2go1
Status: RELEASE
Date: Tue, 21 Oct 2014 12:38:56 +0200
Fixes: 108 159 253 258 336 474 522 525 566 568 571 580 587 590 597 603 607 608 609 612 636
Changes: 
 x2goclient (4.0.3.0-0x2go1) RELEASED; urgency=low
 .
   [ Mike Gabriel ]
   * New upstream release (4.0.3.0):
     - Disallow server-side users to override X2Go Server commands via
       ~/bin (or similar). (Fixes: #336).
     - Avoid unitialised variables on early calls of ONMainWindow::closeEvent()
       or ONMainWindow::closeClient(). (Fixes: #253).
     - Update translation files. Add empty Portuguese translation. Update
       qt_<lang>.qm files from Debian unstable as of today.
     - Update German translation file (after session folder feature got added).
     - Makefile.man2html: Test if man2html exists. If not, don't fail.
     - Honor exports (client-side shared folders) from broker session profiles.
       Thanks to Ming Song for providing a patch for this (Fixes: 612).
   * debian/control:
     + Add B-D: apache2-dev. On squeeze / lucid builds, this is a superfluous
       B-D, but for later Debian/Ubuntu versions, this smoothes the installation
       of the x2goplugin-provide bin:package.
     + Update B-D: apache2-dev | libc6-dev. The apache2-dev package does not
       exist on all Debian/Ubuntu versions.
   * x2goclient.spec:
     + Adapt to building for openSUSE/SLES.
     + openSUSE: Make Qt4 Linguist tools available for Makefile.
     + Upgrade versioned BR for libssh-devel (0.6.3 or patched 0.5.5).
     + The libqt4-linguist split off happened in openSUSE 13.1.
     + Add x2goclient-rpmlintrc file.
     + In openSUSE, it is openldap2-devel, in Fedora/RHEL it is openldap-devel.
     + In openSUSE, openssh is openssh (not openssh-clients / openssh-server).
 .
   [ Oleksandr Shneyder ]
   * New upstream release (4.0.3.0):
     - Fix running x2goclient without arguments on Windows. (Fixes: #522).
     - Save proxy output in $HOME/S-$SESSION-ID/session.log if debugging is
       enabled.
     - Fork x2goclient on windows and terminate child processes if X2Go Client
       crashed. (Fixes: #159).
     - Add "clipboard" parameter to session profile and to command line options.
       (Fixes: #258).
     - Replace qCritical() with printError() by argument parsing.
     - Update translation files.
     - Update russian translation.
     - Update string "&Clipboard Mode" and translate in russian translation file.
     - Grammar fix in russian translation.
     - Add x2gohelper to start X2Go Client on Windows and clean child processes
       if X2Go Client crashes. (Fixes: #525).
     - On Windows rename x2goclient.exe to x2goclient-mainprocess.exe and
       x2gohelper.exe to x2goclient.exe.
     - Start x2gohelper from X2Go Client. Revert name changing of X2Go Client and
       x2gohelper.
     - Add Makefile for x2gohelper.
     - Add support for sessions folders.
     - Add folder explorer: a GUI to manage of session subfolders.
     - Support for sessions subfolders in sessionmanagedialog.
     - Session name autocompletion only for sessions in current folder.
     - Support for session subfolders and command-line options "--session"
       and "--sessionid".
     - Disable session explorer "back" button if user sessions are disabled.
     - Include <QDir> in sessionexplorer.cpp.
     - Remove deprecated workaround in wapi.cpp.
     - Save folder icons Base64 coded. Save icons under General\icon_<PATH>.
       (Fixes: #580).
     - Fix placing sessions folders in broker mode.
     - Fix onmainwindow.cpp after 76ae96781f1d2d5754ee4751539d5de47f1d0297.
     - Add support for session selection in broker mode.
 .
   [ Mike DePaulo ]
   * New upstream release (4.0.3.0):
     - Make X2Go Client aware of the Cinnamon (CINNAMON) desktop environment.
       (Fixes: #571)
     - Make X2Go Client aware of the Trinity (TRINITY) desktop environment.
       (Fixes: #609)
     - Make X2Go Client aware of the Openbox (OPENBOX) window manager.
       (Fixes: #607)
     - Make X2Go Client aware of the IceWM (ICEWM) window manager.
       (Fixes: #608)
     - Windows: Fix not being able to add the server to the known_hosts file when
       the username has non-English characters. (Fixes: #566)
       (NOTE: This fix only works when the non-English characters are in the same
       language as the Windows "system locale" AKA "Language for non-Unicode
       programs." Bug #611 was written for fixing the issue for languages other
       than the system locale.)
       Thanks George Trakatelis (uom.edu.gr) for submitting part of this fix.
     - Windows: Install VcXsrv "misc" fonts by default, and make all 4 font
       groups optional: misc, 75dpi, 100dpi and others (Fixes: #108)
       Note: The fact that all the fonts are included makes the installer about
       30MB larger.
     - Windows: Bundle new version of VcXsrv: 1.15.2.1-xp+vc2013+x2go1
       This new version is based on upstream VcXsrv 1.15.2.0, but still
       compatible with Windows XP. It also has its bundled OpenSSL updated to
       1.0.1j. It is compiled with Microsoft Visual C++ 2013 and contains 1
       X2Go-specific change, winmultiwindow.patch. This patch fixes an issue
       when resizing the NX-proxy window on specific multiple monitor setups.
       (Thanks Oleksandr Shneyder for the patch) (Fixes: #568) (Fixes: #594)
     - Windows: Port from MinGW 4.4 + Qt 4.8.5 to MinGW 4.8.2 + Qt 4.8.6,
       including fix for QTBUG-38706 (Fixes: #474, #603)
     - Windows: Fix missing VcXsrv/zlib1.dll . The impact of this bug was that
       VcXsrv would not start if the cwd was changed from the x2goclient
       directory. (The start menu and desktop shortcuts do have the x2goclient
       directory as the cwd. So they were not affected.) (Fixes: #587)
     - Windows: Make the desktop shortcut optional during install,
       but still the default.
     - Windows: Upgrade libssh from 0.5.5 to 0.6.3. This fixes connecting to
       hpn-enabled SSH servers. The Pageant support patch from the KDE Windows
       project was ported to 0.6.3 by myself and Mike Frederick.
       (Gmail: psududemike) (Fixes: #590)
     - Windows: Win32 OpenSSL updated from 1.0.1h to 1.0.1j, which fixes the
       CVEs announced on 2014-08-06 & 2014-10-15.
     - Windows: Replace Cygwin Bash (sh.exe) with Cygwin Dash (ash.exe renamed
       to sh.exe). This also means fewer Cygwin .DLLs are bundled.
       (Fixes: #636)
     - Windows: cygwin packages (excluding OpenSSH, which is at the patched
       version of 6.6.1p1-3-x2go1) updated from latest versions as of 2014-06-09
       to latest versions as of 2014-10-18. This includes openssl 1.0.1j-1, which
       fixes the CVEs announced on 2014-08-06 & 2014-10.15.
       (Cygwin openssl was also individually updated in 4.0.2.1+hotfix1+build2,
       but only to 1.0.1i-1.)
     - Windows: Build nxproxy.exe with Cygwin's libpng 1.5.x rather than 1.2.x.
       (This may improve performance when PNG compression is selected.)
     - Windows: Build cygwin openssh without krb5 or tcp_wrappers support because
       X2Go Client for Windows does not use either feature.
       (On Windows, Kerberos 5 (GSSAPI) support is provided by PuTTY.)
     - Windows: Fix text not being rendered properly at end of NSIS installer
       (Fixes: #597)
 .
   [ Stefan Baur ]
   * New upstream version (4.0.3.0):
     - Update German translation file.
 .
   [ Ricardo Díaz Martín ]
   * New upstream version (4.0.3.0):
     - Update Spanish translation file.
 .
   [ Martti Pitkanen ]
   * New upstream version (4.0.3.0):
     - Update Finnish translation file.
 .
   [ Jos Wolfram ]
   * New upstream version (4.0.3.0):
     - Update Dutch translation file.
 .
   [ Robert Parts ]
   * New upstream version (4.0.3.0):
     - Add Estonian translation file.
 .
   [ Klaus Ade Johnstad ]
   * New upstream version (4.0.3.0):
     - Update Bokmal (Norway) translation file.
 .
   [ Daniel Lindgren ]
   * New upstream version (4.0.3.0):
     - Update Swedish translation file.
 .
   * Translation status:
     OK - Updating 'x2goclient/x2goclient_de.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     INCOMPLETE - Updating 'x2goclient/x2goclient_da.qm'...
       Generated 536 translation(s) (526 finished and 10 unfinished)
       Ignored 30 untranslated source text(s)
     OK - Updating 'x2goclient/x2goclient_es.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     OK - Updating 'x2goclient/x2goclient_et.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     OK - Updating 'x2goclient/x2goclient_fi.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     INCOMPLETE - Updating 'x2goclient/x2goclient_fr.qm'...
       Generated 254 translation(s) (201 finished and 53 unfinished)
       Ignored 312 untranslated source text(s)
     OK - Updating 'x2goclient/x2goclient_nb_no.qm'...
        Generated 566 translation(s) (566 finished and 0 unfinished)
     OK - Updating 'x2goclient/x2goclient_nl.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     UNTRANSLATED - Updating 'x2goclient/x2goclient_pt.qm'...
       Generated 0 translation(s) (0 finished and 0 unfinished)
       Ignored 566 untranslated source text(s)
     INCOMPLETE - Updating 'x2goclient/x2goclient_ru.qm'...
       Generated 552 translation(s) (543 finished and 9 unfinished)
       Ignored 14 untranslated source text(s)
     OK - Updating 'x2goclient/x2goclient_sv.qm'...
       Generated 566 translation(s) (566 finished and 0 unfinished)
     INCOMPLETE - Updating 'x2goclient/x2goclient_zh_tw.qm'...
       Generated 397 translation(s) (372 finished and 25 unfinished)
       Ignored 169 untranslated source text(s)

Send a report that this bug log contains spam.