[kwin] [Bug 389483] New: VLC leaks playing video details to lock screen

[Tom Chiverton]

https://bugs.kde.org/show_bug.cgi?id=389483

Bug ID: 389483
Summary: VLC leaks playing video details to lock screen
Product: kwin
Version: unspecified
Platform: Kubuntu Packages
OS: Linux
Status: UNCONFIRMED
Severity: critical
Priority: NOR
Component: core
Assignee: kwin-bugs-***@kde.org
Reporter: ***@falkensweb.com
Target Milestone: ---

By default, the lock screen displays the currently playing media on VLC.

This leaks details of media being played to anyone.

Can't see where to flag this as security issue.

[Martin Flöser]

https://bugs.kde.org/show_bug.cgi?id=389483

Martin Flöser <***@kde.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@gmail.com,
| |***@kde.org
Component|core |breeze-theme
Product|kwin |kscreenlocker
Status|UNCONFIRMED |RESOLVED
Resolution|--- |FIXED
Assignee|kwin-bugs-***@kde.org |plasma-***@kde.org

--- Comment #1 from Martin Flöser <***@kde.org> ---
To my knowledge Plasma 5.12 will introduce a config option.

[Tom Chiverton]

https://bugs.kde.org/show_bug.cgi?id=389483

Tom Chiverton <***@falkensweb.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |UNCONFIRMED
Resolution|FIXED |---

--- Comment #2 from Tom Chiverton <***@falkensweb.com> ---
I have plasma-desktop 4:5.12.0-0neon+16.04+xenial+build80 on KDE Neon.

No such option has appeared in workspace->screenlocking under either tab

[Rog131]

https://bugs.kde.org/show_bug.cgi?id=389483

Rog131 <***@hotmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@hotmail.com

--- Comment #3 from Rog131 <***@hotmail.com> ---
By the Plasma 5.12.0 release announcement :
https://www.kde.org/announcements/plasma-5.12.0.php has:

"Media controls have been added to the lock screen. For added privacy, they can
be disabled in Plasma 5.12..."

There is bug report: Bug 384264 - Make it possible to disable media controls on
lock screen - https://bugs.kde.org/show_bug.cgi?id=384264 .

It is marked as fixed with the
https://cgit.kde.org/kscreenlocker.git/commit/?id=e36101cd1b4857a23e05b9d1f039e9358bd1f49b

BUT the 'config.qml' is not shown by the lock screen configuration with the
plasma 5.12.0. Tested with the Neon and with the Arch.

A workaround is to manually edit the
/usr/share/plasma/look-and-feel/org.kde.breeze.desktop/contents/lockscreen/config.xml
. Change the '<default>true</default>' to '<default>false</default>'

[David Edmundson]

https://bugs.kde.org/show_bug.cgi?id=389483

David Edmundson <***@davidedmundson.co.uk> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@davidedmundson.co.uk
Status|UNCONFIRMED |CONFIRMED
Ever confirmed|0 |1

--- Comment #4 from David Edmundson <***@davidedmundson.co.uk> ---
Urgh, there's a bug.

If the "Appareance" tab is not the active tab on load, then it doesn't render
the second QtQuick UI

[Tom Chiverton]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #5 from Tom Chiverton <***@falkensweb.com> ---
Are you going to rate this more seriously then ?

Not only is KDE insecure by default now, but it's not possible to change the
settings to make it more secure!

I'm thinking you want to issue an out-of-band update ASAP...

[David Edmundson]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #6 from David Edmundson <***@davidedmundson.co.uk> ---
The impliciation was that I would fix it.

[David Edmundson]

https://bugs.kde.org/show_bug.cgi?id=389483

David Edmundson <***@davidedmundson.co.uk> changed:

What |Removed |Added
----------------------------------------------------------------------------
Latest Commit| |https://commits.kde.org/ksc
| |reenlocker/639d1809e4d36059
| |03e0efe379f104e35a03fc38
Status|CONFIRMED |RESOLVED
Resolution|--- |FIXED

--- Comment #7 from David Edmundson <***@davidedmundson.co.uk> ---
Git commit 639d1809e4d3605903e0efe379f104e35a03fc38 by David Edmundson.
Committed on 13/02/2018 at 22:29.
Pushed by davidedmundson into branch 'Plasma/5.12'.

Update size hint of lnf config widget

The old code implicitly used the initial size, which depending on when source
is set, was often 0

M +2 -2 kcm/kcm.ui
M +3 -0 kcm/lnfconfig.qml

https://commits.kde.org/kscreenlocker/639d1809e4d3605903e0efe379f104e35a03fc38

[Christoph Feck]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #8 from Christoph Feck <***@kde.org> ---
Thanks Sam for your continues bug triaging efforts. I have just raised your
bugzilla privileges to edit any aspects of bugs (mark duplicates, etc.)

[Tom Chiverton]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #9 from Tom Chiverton <***@falkensweb.com> ---
So is this just getting lumped into the next monthly patch set ?

[Rog131]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #10 from Rog131 <***@hotmail.com> ---
(In reply to Tom Chiverton from comment #9)

Post by Tom Chiverton
So is this just getting lumped into the next monthly patch set ?

It is fixed in branch 'Plasma/5.12'. Next, 5.12.2 , is planned: Tue 2018-02-20.
Plasma Schedules: https://community.kde.org/Schedules/Plasma_5 .

...and yes it is working: [img]Loading Image...[/img]

[David Edmundson]

https://bugs.kde.org/show_bug.cgi?id=389483

Post by Tom Chiverton
So is this just getting lumped into the next monthly patch set ?

Yes.

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

***@gmail.com changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@gmail.com

--- Comment #12 from ***@gmail.com ---
I just updated to Plasma 5.12.3 from the Debian testing repository and I don't
see the new UI in the lock screen settings.

Is there something different about the Debian Plasma packages?

[Rog131]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #13 from Rog131 <***@hotmail.com> ---
(In reply to onitake from comment #12)

Post by b***@kde.org
I just updated to Plasma 5.12.3 from the Debian testing repository and I
don't see the new UI in the lock screen settings.
Is there something different about the Debian Plasma packages?

What do you see ?
Could you add a link to the screen capture ?

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #14 from ***@gmail.com ---
Created attachment 111794
--> https://bugs.kde.org/attachment.cgi?id=111794&action=edit
No lock screen L&F options except wallpaper

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #15 from ***@gmail.com ---
Created attachment 111795
--> https://bugs.kde.org/attachment.cgi?id=111795&action=edit
System settings version dialogue

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #16 from ***@gmail.com ---
Here you go - see the attachments

[Rog131]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #17 from Rog131 <***@hotmail.com> ---
(In reply to onitake from comment #12)

Post by b***@kde.org
I just updated to Plasma 5.12.3 from the Debian testing repository and I
don't see the new UI in the lock screen settings.
Is there something different about the Debian Plasma packages?

A quick test with the Debian, Ubuntu and the Neon:

Debian - not working: https://imgur.com/oluO1Tu
Ubuntu - not working: https://imgur.com/tu1q2iL
Neon - working: https://imgur.com/57EgU2d

Also working, at here, with the Arch Linux.

It seems that the Debian is not executing the
/usr/share/plasma/look-and-feel/org.kde.breeze.desktop/contents/lockscreen/config.qml

Tested with the:

Breaking the config.qml - You should get an error message:
https://imgur.com/fHTtQ2c

With the Debian: No error messages.

and adding the config.qml line: Component.onCompleted: console.log("Executing
this !!")

When executing command: kcmshell5 screenlocker

There should be output: qml: Executing this !!

An image: https://imgur.com/0Td6xBB

With the Debian: No output.


This seems to be an Debian/Ubuntu problem. Maybe a bug repot in the
Debian/Ubuntu bug tracking system will help.

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #18 from ***@gmail.com ---
Thank you very much for debugging this.
I'll open a bug report on the Debian BTS.

[Tom Chiverton]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #19 from Tom Chiverton <***@falkensweb.com> ---
What's the Debian / Ubuntu bug ID ?

[Rog131]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #20 from Rog131 <***@hotmail.com> ---
(In reply to Tom Chiverton from comment #19)

Post by Tom Chiverton
What's the Debian / Ubuntu bug ID ?

The Debian seems to have :
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894815

[b***@kde.org]

https://bugs.kde.org/show_bug.cgi?id=389483

--- Comment #21 from ***@gmail.com ---
Yes, exactly.
That's the bug I created yesterday.

[Robert G. Siebeck]

https://bugs.kde.org/show_bug.cgi?id=389483

Robert G. Siebeck <***@r123.de> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@r123.de

[Jorge Nerín]

https://bugs.kde.org/show_bug.cgi?id=389483

Jorge Nerín <***@gmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@gmail.com