Re: #10481: Hardening LyX against potential misuse

[Tommaso Cucinotta]

On 01/04/2017 07:12, Scott Kostyshak wrote:
Tommaso, any thoughts? Even if you don't have time to implement
something yourself, your opinion would be useful.

Hi,

AFAICR, boundary checks on existing fields of that form, like the
converter file cache expiry time, are all independent/orthogonal of
thehardening patch. I assume it's all good to check the values
and don't allow to save if the inserted values are wrong.

Actually, I just confirmed the weird behavior in setting a negative
value and getting back a non-sense positive one, so I just pushed
a fix for this [1].

Thanks,

        T.

[1]

commit 621ccc5e
Author: Tommaso Cucinotta <tomm...@lyx.org>
Date:   Sun Apr 2 14:55:33 2017 +0200

    Restrict file cache expiry time to positive values.

diff --git a/src/frontends/qt4/GuiPrefs.cpp b/src/frontends/qt4/GuiPrefs.cpp
index 1d8bb201..69877e38 100644
--- a/src/frontends/qt4/GuiPrefs.cpp
+++ b/src/frontends/qt4/GuiPrefs.cpp
@@ -72,6 +72,7 @@
 #include <iomanip>
 #include <sstream>
 #include <algorithm>
+#include <math.h>
 
 using namespace Ui;
 
@@ -1683,7 +1684,7 @@ PrefConverters::PrefConverters(GuiPreferences * form)
 
        converterED->setValidator(new NoNewLineValidator(converterED));
        converterFlagED->setValidator(new NoNewLineValidator(converterFlagED));
-       maxAgeLE->setValidator(new QDoubleValidator(maxAgeLE));
+       maxAgeLE->setValidator(new QDoubleValidator(0, HUGE_VAL, 6, maxAgeLE));
        //converterDefGB->setFocusProxy(convertersLW);
 }