[2/3] CVE-2023-2255 put floating frames under managed links control

[2/3] CVE-2023-2255 put floating frames under managed links control

From 59beb215c3debbdbff0357092b7e7961d69a7298 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Thu, 13 Apr 2023 11:31:17 +0100
Subject: [PATCH 2/3] put floating frames under managed links control
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

like we do for sections and ole objects that link to their content

individual commits in trunk are:

extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse

no behaviour change intended

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825)

use parent window as dialog parent

it makes no odds, but is more convenient for upcoming modification

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99)

adjust IFrameObject so it could reuse mxFrame for a reload of content

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206)

query getUserAllowsLinkUpdate for the case of content in a floating frame

similarly to how it works for the more common "normal" embedded objects

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7)

add a route to get writer Floating Frame links under 'manage links'

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be)

allow SvxOle2Shape::resetModifiedState to survive having no SdrObject

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c)

create the FloatingFrameShape in a separate step to inserting it

this is derived from the path taken by the AddShape(const OUString&)
function for this case. No change in behavior is intended.

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024)

add a route to get calc Floating Frame links under 'manage links'

much harder than writer because the organization and ordering
of properties and object activation etc is different.

This ended up ugly, but functions.

We set FrameURL before AddShape, we have to do it again later because it
gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
FrameURL to exist when AddShape triggers SetPersistName which itself
triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
know what URL will end up being used. So bodge this by setting FrameURL
to the temp pre-SdrOle2Obj attached properties and we can smuggle it
eventually into SdrOle2Obj::SetPersistName at the right point after
PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
in order to inform the link manager that this is an IFrame that links to
a URL

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
bc5333b137d2da089b3b701ff615c6ddf43063d0
7eec3132a23faafd9a2878215a0a117a67bc9bf2
83e38dfa2f84907c2de9680e91f779d34864a9ad
f90ff71d6a96342574799312f764badaf97980eb
ea059262c124e3f44249e49b4189732310d28156
d09ae0c65a55a37743ad7c184070fb8dd97d8a7f
67fc199fef9e67fa12ca7873f0fe12137aa16d8f

Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152132
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
bug: https://www.libreoffice.org/about-us/security/advisories/cve-2023-2255/
bug-debian-security: https://security-tracker.debian.org/tracker/CVE-2023-2255

Gbp-Pq: Name 0079-2-3-CVE-2023-2255-put-floating-frames-under-managed-.patch