commit 323ba3914463107dc75791bd931926c52d771528 Author: Matej Urbančič Date: 2017-07-21 Updated Slovenian translation M po/sl.po commit ef6c1d98e0702d6849d6bbbe4d08cfccb033d243 Author: Bastien Nocera Date: 2017-07-17 comics: Fix extra ";" leading to a warning during installation The concatenated mime-types end up with a ...mime-type;;mime-type... pattern, an empty mime-type, which update-desktop-database doesn't like. Error in file "/usr/share/applications/evince.desktop": "" is an invalid MIME type ("" does not contain a subtype) See https://bugzilla.redhat.com/show_bug.cgi?id=1471474 https://bugzilla.gnome.org/show_bug.cgi?id=785026 M configure.ac commit 8bbcdee7aacd2a1c0e5015108978321a31c9ef66 Author: Bastien Nocera Date: 2017-07-06 comics: Remove support for tar and tar-like commands When handling tar files, or using a command with tar-compatible syntax, to open comic-book archives, both the archive name (the name of the comics file) and the filename (the name of a page within the archive) are quoted to not be interpreted by the shell. But the filename is completely with the attacker's control and can start with "--" which leads to tar interpreting it as a command line flag. This can be exploited by creating a CBT file (a tar archive with the .cbt suffix) with an embedded file named something like this: "--checkpoint-action=exec=bash -c 'touch ~/hacked;'.jpg" CBT files are infinitely rare (CBZ is usually used for DRM-free commercial releases, CBR for those from more dubious provenance), so removing support is the easiest way to avoid the bug triggering. All this code was rewritten in the development release for GNOME 3.26 to not shell out to any command, closing off this particular attack vector. This also removes the ability to use libarchive's bsdtar-compatible binary for CBZ (ZIP), CB7 (7zip), and CBR (RAR) formats. The first two are already supported by unzip and 7zip respectively. libarchive's RAR support is limited, so unrar is a requirement anyway. Discovered by Felix Wilhelm from the Google Security Team. https://bugzilla.gnome.org/show_bug.cgi?id=784630 M backend/comics/comics-document.c M configure.ac commit f932396d1c51646a1535eb28d7c8b1281e794a1a Author: Bastien Nocera Date: 2016-09-12 comics: Fix mime-type comparisons The comics backend was using string equality to match mime-types. This doesn't work when the mime-type has changed, and the old name is now simply an alias. Use g_content_type_is_a() instead. https://bugzilla.gnome.org/show_bug.cgi?id=770903 M backend/comics/comics-document.c commit 335c0536c137a8bcc886ca33c1aba6abaf32b99c Author: Bastien Nocera Date: 2016-09-12 comics: Add application/vnd.comicbook+zip support application/vnd.comicbook+zip is the new mime-type for ".cbz" files. Other mime-types are still available as aliases of that type. https://bugzilla.gnome.org/show_bug.cgi?id=770903 M configure.ac commit 438900548bb33551405b7670f666041013a0bdb2 Author: Rafael Fontenelle Date: 2017-03-04 Update Brazilian Portuguese translation A help/pt_BR/figures/add-text-annotation.png A help/pt_BR/figures/annotations-nav-to-page.png A help/pt_BR/figures/annotations-navigate.png A help/pt_BR/figures/list-add-tabs.png A help/pt_BR/figures/print-select.png A help/pt_BR/figures/reverse-collate.png A help/pt_BR/figures/zoom.png M help/pt_BR/pt_BR.po commit 03d74eb4c253a8179b686503651b286611dd8708 Author: hosiet <073plan@gmail.com> Date: 2016-10-30 Update zh_CN translation M po/zh_CN.po commit 48f5f4c78b83118854665408b1ced0857fb82bb7 Author: GNOME Translation Robot Date: 2016-09-12 Updated Scottish Gaelic translation M po/gd.po commit e766015ef464643631f8f711f5df231fa0916619 Author: Matej Urbančič Date: 2016-08-26 Updated Slovenian translation M po/sl.po commit b45c5514eaba86c3c75f8c2f9c42db8b02964fb7 Author: Alexandre Franke Date: 2016-07-27 Updated French translation M po/fr.po commit ea78600fef82f727c0487c611a553d18aebdbbe6 Author: Alexandre Franke Date: 2016-07-27 Updated French translation M help/fr/fr.po commit b18b3dc51a93e12172d22c6b8bb92d32b6e8ebb0 Author: Carlos Garcia Campos Date: 2016-07-17 ev-toolbar: Fix ev_toolbar_has_visible_popups after cb3d4b2 The toolbar was changed to use popovers for the view and actions menus, but ev_toolbar_has_visible_popups was still checking if the actions had a GtkMenu visible. M shell/ev-toolbar.c commit f2c71346f6c59859ce07123a3ba928c0875fd13a Author: Paul Menzel Date: 2016-06-27 Fix spelling of *dependency* https://bugzilla.gnome.org/show_bug.cgi?id=768102 M ChangeLog.pre-git M NEWS commit 33bdb4d390ca7368ad847fc99e8af43a506c7110 Author: Carlos Garcia Campos Date: 2016-06-23 release: 3.20.1 M NEWS M configure.ac