swadhin / de-omarchy public
/ docs
s
swadhinbiswas fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal || Qt.quit() } } so Esc dismisses modals then closes standalone quickshell -p plugin-library window - bin/omarchy-plugins:27,204 — ensure_marketplace_catalog curl -sL without TLS pin/fail + eval "$p_cmd" on registry.json:14/catalog.json:15 installCommand (arbitrary remote shell, eval → RCE on omarchy plugins install); harden to curl --proto =https --tlsv1.2 --fail, warn and (cd "$OMARCHY_PATH" && bash -c "$p_cmd") only when repo absent, otherwise prefer omarchy-plugin-add "$p_repo" (validated via bin/omarchy-plugin-validate:115 + PluginRegistry.qml:603 reserved omarchy.* check) - shell/plugins/plugin-library/Panel.qml + manifest.json — delete duplicate copy-pasted Panel.qml:12 moduleName:"deomarchy.plugin-manager"/ipcTarget:"deomarchy.plugin-manager" while manifest.json:3 declares id:"deomarchy.plugin-library" → duplicate IpcHandler registration (Handler was registered but will not be used) and spurious openlayer>>omarchy-plugin-manager / width null at Panel.qml:1021
4aa0eee · committed 1 months ago
History
.. ..
audio-tuning.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
cli-router.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
file-layout.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
FORK-NOTES.md fix(plugin-manager): close on Esc/outside-click and harden marketplace RCE - shell/plugins/plugin-manager/Panel.qml:6,139,149,155,358,368,384,404,409,426,439,457,508 — PanelWindow had WlrKeyboardFocus: Exclusive always, no PanelKeyCatcher/Keys.onEscape and no outside-click MouseArea → once opened via keymap.lua:159 SUPER+SHIFT+I (shell/shell.qml:465 summon) only bar-icon BarWidget.qml:67 could close; add Quickshell.Wayland import, keyboardFocus: opened?Exclusive:None, onVisibleChanged/onOpenedChanged Qt.callLater(keyCatcher.forceActiveFocus()), scrim Qt.rgba(0,0,0,0.45), dismiss MouseArea (modal-aware) + Item#keyCatcher { focus:true; Keys.priority:BeforeItem; Esc->closeModal/close } + card swallow MouseArea, mirrors clipboard/Clipboard.qml:329; fix loadInstalled/loadMarketplace and all actionProc.command single-quote injections (enable/disable, bar remove/add, shortcut set/remove, install, install url, remove) → Util.shellQuote - plugin-library/shell.qml:104,115,121,429,439,455,475,480,495,508,526 — same injection via "'"+p.id+"'" without quoting (marketplace id/url/keys controlled by remote catalog) → add local shellQuote(v) (Util.shellQuote not importable in standalone ShellRoot) and use for all actionProc.command + loadInstalled/loadMarketplace (home/om paths); add Window#win Item { focus:true; Keys.onPressed: Esc { closeModal 1 months ago
menu.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
notifications.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
omarchy-shell.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
testing.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
theming.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago
update-process.md Vendor upstream docs, manual, agent guides; add fork brief and parity audit 2 months ago

About

Beautiful, Modern & Opinionated Linux for non omarchy Users

opencodehub.local/swadhin/de-omarchy
None license
Updated 22 days ago