Limit CVE-2017-17689 (EFAIL) in KMail #70

The patches are taken from KDE and adapted for TDE. Because we do not have a separate library messagelib, patches for messagelib and KMail as such are merged into one. Therefore, there are two patches instead of three patches. See https://dot.kde.org/2018/05/15/efail-and-kmail

This resolve issue #22.

Look good. Have not tested, but it's surprising to see how simple the fix is.

Look good. Have not tested, but it's surprising to see how simple the fix is.

I did not do additional research – I just came out of the conclusions in the overview of the impact of the problem on individual clients at https://efail.de/ and the patches that were applied to KMail in KDE.

The patches deal with, for encrypted messages, it is always necessary to confirm the loading of parts from external sources. That is, for the user to always check what will be loaded. Therefore, they are quite simple.

This requires further testing and adjustments, because the behavior with patches is not as intended.

Resetting override flag has been added to the slot responding to the message selection.

Turning on to load external links at the folder level does not have the expected behavior. So it requires another effort.

Testing !mMessage was misleading and caused an unwanted result. Set the mViewer->setOnlyLocalReferences(!htmlLoadExternal()); moved to the moment when the message that is currently displayed is already loaded.

I did tests and it seems that now everything really works as it was intended.

Looks good.

Limit CVE-2017-17689 (EFAIL) in KMail #70

Reviewers