Makefile.in                                            |    5 
 binaryurp/source/binaryurp.component                   |    2 
 config_host.mk.in                                      |    1 
 configure.ac                                           |   76 +++++++++----
 connectivity/source/drivers/macab/MacabAddressBook.cxx |    7 +
 lo.xcent.in                                            |   12 --
 oox/source/drawingml/fillproperties.cxx                |   96 +++++++----------
 oox/source/ole/vbacontrol.cxx                          |    6 -
 sd/qa/unit/data/pptx/croppedTo0.pptx                   |binary
 sd/qa/unit/import-tests2.cxx                           |   11 +
 sd/source/ui/dlg/RemoteDialog.cxx                      |    2 
 sd/source/ui/dlg/tpoption.cxx                          |    2 
 sd/source/ui/func/fuarea.cxx                           |    8 -
 sfx2/source/appl/sfxhelp.cxx                           |   16 ++
 shell/source/win32/simplemail/senddoc.cxx              |   38 ++++--
 shell/source/win32/simplemail/smplmailclient.cxx       |   16 ++
 shell/source/win32/simplemail/smplmailclient.hxx       |    2 
 sw/source/core/table/swtable.cxx                       |    6 -
 sw/source/ui/misc/pggrid.cxx                           |   10 +
 sysui/desktop/macosx/Info.plist.in                     |    2 
 ucb/source/ucp/webdav-curl/CurlSession.cxx             |    9 +
 vcl/Library_vclplug_osx.mk                             |    8 +
 22 files changed, 218 insertions(+), 117 deletions(-)

New commits:
commit a99be0a6a5cf8d32ae2db93cb8bc8735b2ca8417
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 13:35:01 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:29 2022 +0200

    allow to specify a macOS provisioning profile
    
    having one is one of the prerequisites of using TestFlight
    
    Change-Id: I9e20eb99905071fade4179dfbe2da5b7e5dd1c24
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136618
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit b43f0b0295953c8d5d16c5b9eccaddb5ec214bab)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136695

diff --git a/Makefile.in b/Makefile.in
index d3f1047be4ca..a5ae689b614e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -387,7 +387,9 @@ ifneq ($(ENABLE_MACOSX_SANDBOX),)
        rm 
$(TESTINSTALLDIR)/$(PRODUCTNAME_WITHOUT_SPACES).app/Contents/MacOS/unopkg
        rm 
$(TESTINSTALLDIR)/$(PRODUCTNAME_WITHOUT_SPACES).app/Contents/MacOS/unoinfo
 endif
-#
+ifneq ($(MACOSX_PROVISIONING_PROFILE),)
+       cp "$(MACOSX_PROVISIONING_PROFILE)" 
$(TESTINSTALLDIR)/$(PRODUCTNAME_WITHOUT_SPACES).app/Contents/embedded.provisionprofile
+endif
 ifneq ($(MACOSX_CODESIGNING_IDENTITY),)
 # Then use the macosx-codesign-app-bundle script
        @$(SRCDIR)/solenv/bin/macosx-codesign-app-bundle 
$(TESTINSTALLDIR)/$(PRODUCTNAME_WITHOUT_SPACES).app
diff --git a/config_host.mk.in b/config_host.mk.in
index 73b367290f65..fe0a3ef06e19 100644
--- a/config_host.mk.in
+++ b/config_host.mk.in
@@ -430,6 +430,7 @@ export MACOSX_BUNDLE_IDENTIFIER=@MACOSX_BUNDLE_IDENTIFIER@
 export MACOSX_CODESIGNING_IDENTITY=@MACOSX_CODESIGNING_IDENTITY@
 export MACOSX_DEPLOYMENT_TARGET=@MACOSX_DEPLOYMENT_TARGET@
 export MACOSX_PACKAGE_SIGNING_IDENTITY=@MACOSX_PACKAGE_SIGNING_IDENTITY@
+export MACOSX_PROVISIONING_PROFILE=@MACOSX_PROVISIONING_PROFILE@
 export MACOSX_SDK_PATH=@MACOSX_SDK_PATH@
 export MAC_OS_X_VERSION_MAX_ALLOWED=@MAC_OS_X_VERSION_MAX_ALLOWED@
 export MAC_OS_X_VERSION_MIN_REQUIRED=@MAC_OS_X_VERSION_MIN_REQUIRED@
diff --git a/configure.ac b/configure.ac
index 3f66c6c10fee..568a1867786a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1843,6 +1843,11 @@ AC_ARG_WITH(macosx-bundle-identifier,
          org.libreoffice.script ("script", huh?).]),
 ,with_macosx_bundle_identifier=org.libreoffice.script)
 
+AC_ARG_WITH(macosx-provisioning-profile,
+    
AS_HELP_STRING([--with-macosx-provisioning-profile=/path/to/mac.provisionprofile],
+        [Specify the path to a provisioning profile to use]),
+,)
+
 AC_ARG_WITH(product-name,
     AS_HELP_STRING([--with-product-name='My Own Office Suite'],
         [Define the product name. Default is AC_PACKAGE_NAME.]),
@@ -3559,6 +3564,18 @@ if test $_os = Darwin; then
     AC_MSG_CHECKING([what macOS app bundle identifier to use])
     MACOSX_BUNDLE_IDENTIFIER=$with_macosx_bundle_identifier
     AC_MSG_RESULT([$MACOSX_BUNDLE_IDENTIFIER])
+
+    if test -n "$with_macosx_provisioning_profile" ; then
+        if test ! -f "$with_macosx_provisioning_profile"; then
+            AC_MSG_ERROR([provisioning profile not found at 
$with_macosx_provisioning_profile])
+        else
+            MACOSX_PROVISIONING_PROFILE=$with_macosx_provisioning_profile
+            MACOSX_PROVISIONING_INFO=$([security cms -D -i 
"$MACOSX_PROVISIONING_PROFILE" | \
+                xmllint --xpath "//key[.='com.apple.application-identifier' or 
.='com.apple.developer.team-identifier'] \
+                    | //key[.='com.apple.application-identifier' or 
.='com.apple.developer.team-identifier']/following-sibling::string[1]" - | \
+                sed -e 's#><#>\n\t<#g' -e 's#^#\t#'])
+        fi
+    fi
 fi
 AC_SUBST(MACOSX_SDK_PATH)
 AC_SUBST(MACOSX_DEPLOYMENT_TARGET)
@@ -3570,6 +3587,8 @@ AC_SUBST(MACOSX_CODESIGNING_IDENTITY)
 AC_SUBST(MACOSX_PACKAGE_SIGNING_IDENTITY)
 AC_SUBST(ENABLE_MACOSX_SANDBOX)
 AC_SUBST(MACOSX_BUNDLE_IDENTIFIER)
+AC_SUBST(MACOSX_PROVISIONING_INFO)
+AC_SUBST(MACOSX_PROVISIONING_PROFILE)
 
 dnl ===================================================================
 dnl Check iOS SDK and compiler
diff --git a/lo.xcent.in b/lo.xcent.in
index 9a0838fbc388..4b7303876e6b 100644
--- a/lo.xcent.in
+++ b/lo.xcent.in
@@ -22,5 +22,6 @@
         <key>com.apple.security.personal-information.addressbook</key>
         <true/>
 @SDREMOTE_ENTITLEMENT@
+@MACOSX_PROVISIONING_INFO@
 </dict>
 </plist>
commit 0cd0744a22d9370c891a226e756e6535ee605a48
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Thu Jun 30 22:23:30 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:29 2022 +0200

    tdf#149603 macOS: fix workaround to use web help if Safari is the default 
browser
    
    Safari won't access the local helpfiles from LO's app folder unless you
    enable Safari's webdeveloper menu. The workaround broke since
    f31f0038f5fd9254584a06665066faf9715d1cd8 switched from window to widget
    references and hence using a different codepath, skipping the workaround
    added in 44893662d510c4173e55ba27af02d0258a697a5d
    
    Change-Id: I0c59066fe1cef1514c6595e0439d31d3e60e02f3
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136685
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 82acd35e3cc5dc458930daaf6de9f41c7deb73dc)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136704

diff --git a/sfx2/source/appl/sfxhelp.cxx b/sfx2/source/appl/sfxhelp.cxx
index 73d86cba8266..889c669241d0 100644
--- a/sfx2/source/appl/sfxhelp.cxx
+++ b/sfx2/source/appl/sfxhelp.cxx
@@ -1281,6 +1281,22 @@ bool SfxHelp::Start_Impl(const OUString& rURL, 
weld::Widget* pWidget, const OUSt
         impl_showOnlineHelp(aHelpURL, pWidget);
         return true;
     }
+#ifdef MACOSX
+    if (@available(macOS 10.14, *)) {
+        // Workaround: Safari sandboxing prevents it from accessing files in 
the LibreOffice.app folder
+        // force online-help instead if Safari is default browser.
+        CFURLRef pBrowser = LSCopyDefaultApplicationURLForURL(
+                                CFURLCreateWithString(
+                                    kCFAllocatorDefault,
+                                    
static_cast<CFStringRef>(@"https://www.libreoffice.org";),
+                                    nullptr),
+                                kLSRolesAll, nullptr);
+        if([static_cast<NSString*>(CFURLGetString(pBrowser)) 
isEqualToString:@"file:///Applications/Safari.app/"]) {
+            impl_showOnlineHelp(aHelpURL, pWidget);
+            return true;
+        }
+    }
+#endif
 
     // If the HTML or no help is installed, but aHelpURL nevertheless 
references valid help content,
     // that implies that help content belongs to an extension (and thus would 
not be available
commit b8a9a2038e8f6fc1e9c3f99b72fcee763618c63d
Author:     Xisco Fauli <[email protected]>
AuthorDate: Tue May 31 13:42:23 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:29 2022 +0200

    sw: avoid another EXCEPTION_INT_DIVIDE_BY_ZERO
    
    See https://crashreport.libreoffice.org/stats/signature/lcl_ModifyBoxes
    
    Change-Id: I786bbf87734dd3963bd84caecc5c5f45693d42c4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135185
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit aeeb0141aca4f1698b09bc8f06ded41247b54279)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135255
    Reviewed-by: Christian Lohmaier <[email protected]>

diff --git a/sw/source/core/table/swtable.cxx b/sw/source/core/table/swtable.cxx
index da159df14bd2..7992b430328b 100644
--- a/sw/source/core/table/swtable.cxx
+++ b/sw/source/core/table/swtable.cxx
@@ -249,7 +249,8 @@ namespace
 template<class T>
 T lcl_MulDiv64(sal_uInt64 nA, sal_uInt64 nM, sal_uInt64 nD)
 {
-    return static_cast<T>((nA*nM)/nD);
+    assert(nD != 0);
+    return nD == 0 ? static_cast<T>(nA*nM) : static_cast<T>((nA*nM)/nD);
 }
 
 }
@@ -299,8 +300,7 @@ static void lcl_ModifyBoxes( SwTableBoxes &rBoxes, const 
tools::Long nOld,
         SwFrameFormat *pFormat = rBox.GetFrameFormat();
         sal_uInt64 nBox = pFormat->GetFrameSize().GetWidth();
         nOriginalSum += nBox;
-        nBox *= nNew;
-        nBox /= nOld;
+        nBox = lcl_MulDiv64<sal_uInt64>(nBox, nNew, nOld);
         const sal_uInt64 nWishedSum = lcl_MulDiv64<sal_uInt64>(nOriginalSum, 
nNew, nOld) - nSum;
         if( nWishedSum > 0 )
         {
commit 80f3985e8dd4673654bbabe4e0d638bfe2ef07c1
Author:     Caolán McNamara <[email protected]>
AuthorDate: Thu Jun 30 16:28:47 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:29 2022 +0200

    tdf#149787 capture a copy of mpViewShell and mpView
    
    so the callback can outlive the FuArea
    
    Change-Id: I392ffa46b6f13795faef7284c1cae74428655b5f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136694
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sd/source/ui/func/fuarea.cxx b/sd/source/ui/func/fuarea.cxx
index e75ab54a8f9a..345b2c70b6dc 100644
--- a/sd/source/ui/func/fuarea.cxx
+++ b/sd/source/ui/func/fuarea.cxx
@@ -57,10 +57,10 @@ void FuArea::DoExecute( SfxRequest& rReq )
     SvxAbstractDialogFactory* pFact = SvxAbstractDialogFactory::Create();
     VclPtr<AbstractSvxAreaTabDialog> 
pDlg(pFact->CreateSvxAreaTabDialog(mpViewShell->GetFrameWeld(), &aNewAttr, 
mpDoc, true));
 
-    pDlg->StartExecuteAsync([pDlg, this](sal_Int32 nResult){
+    pDlg->StartExecuteAsync([pDlg, pView = this->mpView, pViewShell = 
this->mpViewShell](sal_Int32 nResult){
         if (nResult == RET_OK)
         {
-            mpView->SetAttributes (*(pDlg->GetOutputItemSet ()));
+            pView->SetAttributes (*(pDlg->GetOutputItemSet ()));
 
             // attributes changed, update Listboxes in Objectbars
             static const sal_uInt16 SidArray[] = {
@@ -73,11 +73,11 @@ void FuArea::DoExecute( SfxRequest& rReq )
                 SID_ATTR_FILL_FLOATTRANSPARENCE,
                 0 };
 
-            mpViewShell->GetViewFrame()->GetBindings().Invalidate( SidArray );
+            pViewShell->GetViewFrame()->GetBindings().Invalidate( SidArray );
         }
 
         // deferred until the dialog ends
-        mpViewShell->Cancel();
+        pViewShell->Cancel();
 
         pDlg->disposeOnce();
     });
commit 2fa7263cc637837fda163474c91496cb975c5418
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Tue Jun 21 13:45:00 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    allow pretty names in --enable-macosx-code/package-signing
    
    also reorder the logic to avoid duplicating the matches for default
    value and manually provided one.
    
    Change-Id: I4466cbeaf5abd7168f21e22cd910f63568c14e24
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136224
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 2f5b54ba51157a2346e10dfb82e3d434d6030aaa)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136551
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/configure.ac b/configure.ac
index a89d20ba7bde..3f66c6c10fee 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3491,16 +3491,22 @@ if test $_os = Darwin; then
 
     AC_MSG_CHECKING([whether to do code signing])
 
-    if test "$enable_macosx_code_signing" = yes; then
-        # By default use the first suitable certificate (?).
-
-        # 
http://stackoverflow.com/questions/13196291/difference-between-mac-developer-and-3rd-party-mac-developer-application
-        # says that the "Mac Developer" certificate is useful just for 
self-testing. For distribution
-        # outside the Mac App Store, use the "Developer ID Application" one, 
and for distribution in
-        # the App Store, the "3rd Party Mac Developer" one. I think it works 
best to the
-        # "Developer ID Application" one.
+    if test -z "$enable_macosx_code_signing" -o "$enable_macosx_code_signing" 
== "no" ; then
+        AC_MSG_RESULT([no])
+    else
+        if test "$enable_macosx_code_signing" = yes; then
+            # By default use the first suitable certificate (?).
 
-        identity=`security find-identity -p codesigning -v 2>/dev/null | grep 
'Developer ID Application:' | $AWK '{print $2}' |head -1`
+            # 
http://stackoverflow.com/questions/13196291/difference-between-mac-developer-and-3rd-party-mac-developer-application
+            # says that the "Mac Developer" certificate is useful just for 
self-testing. For distribution
+            # outside the Mac App Store, use the "Developer ID Application" 
one, and for distribution in
+            # the App Store, the "3rd Party Mac Developer" one. I think it 
works best to the
+            # "Developer ID Application" one.
+            identity="Developer ID Application:"
+        else
+            identity=$enable_macosx_code_signing
+        fi
+        identity=`security find-identity -p codesigning -v 2>/dev/null | $AWK 
"/$identity/{print \\$2; exit}"`
         if test -n "$identity"; then
             MACOSX_CODESIGNING_IDENTITY=$identity
             pretty_name=`security find-identity -p codesigning -v | grep 
"$MACOSX_CODESIGNING_IDENTITY" | sed -e 's/^[[^"]]*"//' -e 's/"//'`
@@ -3508,12 +3514,6 @@ if test $_os = Darwin; then
         else
             AC_MSG_ERROR([cannot determine identity to use])
         fi
-    elif test -n "$enable_macosx_code_signing" -a 
"$enable_macosx_code_signing" != no ; then
-        MACOSX_CODESIGNING_IDENTITY=$enable_macosx_code_signing
-        pretty_name=`security find-identity -p codesigning -v | grep 
"$MACOSX_CODESIGNING_IDENTITY" | sed -e 's/^[[^"]]*"//' -e 's/"//'`
-        AC_MSG_RESULT([yes, using the identity $MACOSX_CODESIGNING_IDENTITY 
for $pretty_name])
-    else
-        AC_MSG_RESULT([no])
     fi
 
     AC_MSG_CHECKING([whether to create a Mac App Store package])
@@ -3522,11 +3522,15 @@ if test $_os = Darwin; then
         AC_MSG_RESULT([no])
     elif test -z "$MACOSX_CODESIGNING_IDENTITY"; then
         AC_MSG_ERROR([You forgot --enable-macosx-code-signing])
-    elif test "$enable_macosx_package_signing" = yes; then
-        # By default use the first suitable certificate.
-        # It should be a "3rd Party Mac Developer Installer" one
-
-        identity=`security find-identity -v 2>/dev/null | grep '3rd Party Mac 
Developer Installer:' | awk '{print $2}' |head -1`
+    else
+        if test "$enable_macosx_package_signing" = yes; then
+            # By default use the first suitable certificate.
+            # It should be a "3rd Party Mac Developer Installer" one
+            identity="3rd Party Mac Developer Installer:"
+        else
+            identity=$enable_macosx_package_signing
+        fi
+        identity=`security find-identity -v 2>/dev/null | $AWK "/$identity/ 
{print \\$2; exit}"`
         if test -n "$identity"; then
             MACOSX_PACKAGE_SIGNING_IDENTITY=$identity
             pretty_name=`security find-identity -v | grep 
"$MACOSX_PACKAGE_SIGNING_IDENTITY" | sed -e 's/^[[^"]]*"//' -e 's/"//'`
@@ -3534,10 +3538,6 @@ if test $_os = Darwin; then
         else
             AC_MSG_ERROR([Could not find any suitable '3rd Party Mac Developer 
Installer' certificate])
         fi
-    else
-        MACOSX_PACKAGE_SIGNING_IDENTITY=$enable_macosx_package_signing
-        pretty_name=`security find-identity -v | grep 
"$MACOSX_PACKAGE_SIGNING_IDENTITY" | sed -e 's/^[[^"]]*"//' -e 's/"//'`
-        AC_MSG_RESULT([yes, using the identity 
$MACOSX_PACKAGE_SIGNING_IDENTITY for $pretty_name])
     fi
 
     if test -n "$MACOSX_CODESIGNING_IDENTITY" -a -n 
"$MACOSX_PACKAGE_SIGNING_IDENTITY" -a "$MACOSX_CODESIGNING_IDENTITY" = 
"$MACOSX_PACKAGE_SIGNING_IDENTITY"; then
commit 9b744661fd39c4c897110a4b61e3957570881f07
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 13:50:30 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    related tdf#126961 don't crash when access to the macOS address book is 
denied
    
    quick'n'dirty fix, ideally the user should get a message to reset the
    privacy setting and try again...
    
    Change-Id: I51cb852e305e285c87ff3a0e15b5198a2b1c5970
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136620
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 5ab29d945a18824eec53426edece4f19a02610ed)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136640
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/connectivity/source/drivers/macab/MacabAddressBook.cxx 
b/connectivity/source/drivers/macab/MacabAddressBook.cxx
index a14b7abee9b9..02d4faf74290 100644
--- a/connectivity/source/drivers/macab/MacabAddressBook.cxx
+++ b/connectivity/source/drivers/macab/MacabAddressBook.cxx
@@ -82,6 +82,13 @@ MacabAddressBook::MacabAddressBook( )
    m_xMacabRecords(nullptr),
    m_bRetrievedGroups(false)
 {
+    if(m_aAddressBook == nullptr)
+    {
+        // TODO: tell the user to reset the permission via "tccutil reset 
AddressBook"
+        // or the system preferences and try again, this time granting the 
access
+        throw RuntimeException(
+            "failed to access the macOS address book - permission not 
granted?" );
+    }
 }
 
 
commit 0d6ec5922036afd91497fa02e0adadb08b0af7d0
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 13:17:14 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    don't specify entitlements that are not used (sdremote w/o bluetooth)
    
    the network.server entitlement is only needed when the sdremote is
    enabled, and the bluetooth one only when the bluetooth part is built.
    Also warn about bluetooth not being built because of obsoleted/removed
    API. It was "silently" dropped before (lost in the flood of configure
    output).
    
    Change-Id: I38d83aa1132307b5b4b5d6dceba8f9020ffb2373
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136617
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136626
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/Makefile.in b/Makefile.in
index d74dba59344c..d3f1047be4ca 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -225,6 +225,7 @@ distclean : clean compilerplugins-clean
         $(BUILDDIR)/configure \
         $(BUILDDIR)/hardened_runtime.xcent \
         $(BUILDDIR)/instsetoo_native/util/openoffice.lst \
+        $(BUILDDIR)/lo.xcent \
         $(BUILDDIR)/sysui/desktop/macosx/Info.plist \
         $(BUILDDIR)/vs-code-template.code-workspace
        $(if $(filter WNT,$(OS)),env -i PATH="$$PATH") $(FIND) 
$(SRCDIR)/solenv/gdb -name \*.pyc -exec rm {} \;
diff --git a/configure.ac b/configure.ac
index f3375595e235..a89d20ba7bde 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5501,6 +5501,7 @@ if test "$cross_compiling" = "yes"; then
         config_host.mk.in \
         config_host_lang.mk.in \
         Makefile.in \
+        lo.xcent.in \
         bin/bffvalidator.sh.in \
         bin/odfvalidator.sh.in \
         bin/officeotron.sh.in \
@@ -11834,6 +11835,8 @@ AC_MSG_CHECKING([whether to enable Impress remote 
control])
 if test -n "$enable_sdremote" -a "$enable_sdremote" != "no"; then
     AC_MSG_RESULT([yes])
     ENABLE_SDREMOTE=TRUE
+    SDREMOTE_ENTITLEMENT="     <key>com.apple.security.network.server</key>
+       <true/>"
     AC_MSG_CHECKING([whether to enable Bluetooth support in Impress remote 
control])
 
     if test $OS = MACOSX && test "$MACOSX_SDK_VERSION" -ge 101500; then
@@ -11841,6 +11844,7 @@ if test -n "$enable_sdremote" -a "$enable_sdremote" != 
"no"; then
         if test "$enable_sdremote_bluetooth" = yes; then
             AC_MSG_ERROR([macOS SDK $macosx_sdk does not currently support 
--enable-sdremote-bluetooth])
         fi
+        add_warning "not building the bluetooth part of the sdremote - used 
api was removed from macOS SDK 10.15"
         enable_sdremote_bluetooth=no
     fi
     # If not explicitly enabled or disabled, default
@@ -11890,6 +11894,9 @@ if test -n "$enable_sdremote" -a "$enable_sdremote" != 
"no"; then
         AC_MSG_RESULT([no])
         ENABLE_SDREMOTE_BLUETOOTH=
         SYSTEM_BLUEZ=
+        SDREMOTE_ENTITLEMENT="$SDREMOTE_ENTITLEMENT
+       <key>com.apple.security.device.bluetooth</key>
+       <true/>"
     fi
 else
     ENABLE_SDREMOTE=
@@ -11898,6 +11905,7 @@ else
 fi
 AC_SUBST(ENABLE_SDREMOTE)
 AC_SUBST(ENABLE_SDREMOTE_BLUETOOTH)
+AC_SUBST(SDREMOTE_ENTITLEMENT)
 AC_SUBST(SYSTEM_BLUEZ)
 
 dnl ===================================================================
@@ -14724,6 +14732,7 @@ AC_CONFIG_LINKS([include:include])
 AC_CONFIG_FILES([config_host.mk
                  config_host_lang.mk
                  Makefile
+                 lo.xcent
                  bin/bffvalidator.sh
                  bin/odfvalidator.sh
                  bin/officeotron.sh
diff --git a/lo.xcent b/lo.xcent.in
similarity index 74%
rename from lo.xcent
rename to lo.xcent.in
index 56bb981916fe..9a0838fbc388 100644
--- a/lo.xcent
+++ b/lo.xcent.in
@@ -14,16 +14,13 @@
        <true/>
        <key>com.apple.security.network.client</key>
        <true/>
-       <key>com.apple.security.network.server</key>
-       <true/>
-       <key>com.apple.security.device.bluetooth</key>
-       <true/>
        <key>com.apple.security.print</key>
        <true/>
         <key>com.apple.security.cs.disable-executable-page-protection</key>
         <true/>
-    <!-- Allow Base to import data from Address Book -->
-    <key>com.apple.security.personal-information.addressbook</key>
-    <true/>
+        <!-- Allow Base to import data from Address Book -->
+        <key>com.apple.security.personal-information.addressbook</key>
+        <true/>
+@SDREMOTE_ENTITLEMENT@
 </dict>
 </plist>
commit 0627e9c108de978e612b76e3a101b6e5e477aed5
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 13:43:37 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    tdf#126961 fix access to the macOS address book
    
    Having the personal-information.addressbook entitlement is not enough.
    Without the plist key NSContactsUsageDescription, macOS will not ask the
    user to grant access and the request is implicitly denied without any
    feedback/logging.
    
    Change-Id: I954fa86b35a128f08e5c498191bc0949e0edeebf
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136619
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit ccf518a6fd2819e6a328e953d5e7356d8d9bd11f)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136637
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/sysui/desktop/macosx/Info.plist.in 
b/sysui/desktop/macosx/Info.plist.in
index e50d7a20c4dd..6593139019fc 100644
--- a/sysui/desktop/macosx/Info.plist.in
+++ b/sysui/desktop/macosx/Info.plist.in
@@ -1959,6 +1959,8 @@
     <string>@[email protected]</string>
     <key>NSHighResolutionCapable</key>
     <true/>
+    <key>NSContactsUsageDescription</key>
+    <string>You can add your contacts as a data source for mail merge or 
similar operations.</string>
 </dict>
 </plist>
 <!-- vim:set shiftwidth=4 softtabstop=4 expandtab: -->
commit 55c8a75caf91357defdf66bb2163297667a5c14b
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 12:32:47 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    tdf#141313 only hide Impress Remote option if there is no sdremote at all
    
    it was incorrectly based on bluetooth support, but the remote can also
    be used in the local network.
    Regression from 4cdb960a79aff565f956f618116f3ea4b3836aa4 still worked
    for users who had it enabled in earlier versions, but not with new
    profiles.
    
    Change-Id: Ib4026c60fed0842b3bad483d78e46dd73d1d75f5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136615
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 8d7c441097cc0279a9819fe0673b8cad40ae94db)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136642
    Tested-by: Christian Lohmaier <[email protected]>
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/sd/source/ui/dlg/tpoption.cxx b/sd/source/ui/dlg/tpoption.cxx
index 1da1974bedb7..d329e34c20d2 100644
--- a/sd/source/ui/dlg/tpoption.cxx
+++ b/sd/source/ui/dlg/tpoption.cxx
@@ -498,7 +498,7 @@ IMPL_LINK_NOARG(SdTpOptionsMisc, SelectMetricHdl_Impl, 
weld::ComboBox&, void)
 
 void SdTpOptionsMisc::SetImpressMode()
 {
-#ifndef ENABLE_SDREMOTE_BLUETOOTH
+#ifndef ENABLE_SDREMOTE
     m_xCbxEnableSdremote->hide();
 #else
     (void) this; // loplugin:staticmethods
commit bdc9f35d49f015e34c3a3ef016d79b620e407b4f
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 12:36:28 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    impress remote connection dialog must also work without bluetooth
    
    as otherwise you can never confirm the pin to approve new devices.
    old regression from 7c8c73dd5cf84050a8a2c51b04d7f5278b409fd7
    still worked for users who had it enabled/linked in a previous
    version...
    
    Change-Id: Icf9fb6ae4259252da47c3709ab99fb7a2a70aeac
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136616
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit c7147cd2504d1d3f91ca5b0a5e119ca9d2185b37)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136635
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/sd/source/ui/dlg/RemoteDialog.cxx 
b/sd/source/ui/dlg/RemoteDialog.cxx
index e54b130c3a57..e28f57ecdecc 100644
--- a/sd/source/ui/dlg/RemoteDialog.cxx
+++ b/sd/source/ui/dlg/RemoteDialog.cxx
@@ -27,7 +27,7 @@ RemoteDialog::~RemoteDialog() {}
 IMPL_LINK_NOARG(RemoteDialog, HandleConnectButton, weld::Button&, void)
 {
     weld::WaitObject(m_xDialog.get());
-#if defined(ENABLE_SDREMOTE) && defined(ENABLE_SDREMOTE_BLUETOOTH)
+#if defined(ENABLE_SDREMOTE)
     auto xEntry = m_xClientBox->GetActiveEntry();
     if (!xEntry)
         return;
commit 489dff5832c6e96175ff37380e1743014cf7ffda
Author:     Christian Lohmaier <[email protected]>
AuthorDate: Wed Jun 29 12:28:45 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 17:08:28 2022 +0200

    Don't link against private CoreUI framework when sandboxed
    
    Actual use of the code was already disabled since 2014 with
    b8bee05dbf85bc4f5834520aa5d64e9ae18aba4e - but the link flags were not
    conditionalized.
    
    Change-Id: Ia1dd299cb78274850eb6a7b10259991bb4970ab9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136614
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 7a493a7d64dc634ae2d5d6931b8ce33223cb3985)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136553
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/vcl/Library_vclplug_osx.mk b/vcl/Library_vclplug_osx.mk
index e2a1a5161bdd..e0adee810a30 100644
--- a/vcl/Library_vclplug_osx.mk
+++ b/vcl/Library_vclplug_osx.mk
@@ -30,10 +30,14 @@ $(eval $(call gb_Library_use_custom_headers,vclplug_osx,\
     officecfg/registry \
 ))
 
+# TODO: arguably the private CoreUI framework should never be used, no matter 
whether building
+# a sandboxed version or a "regular" desktop version
 $(eval $(call gb_Library_add_libs,vclplug_osx,\
     -framework IOKit \
-    -F/System/Library/PrivateFrameworks \
-    -framework CoreUI \
+    $(if $(ENABLE_MACOSX_SANDBOX),,\
+        -F/System/Library/PrivateFrameworks \
+        -framework CoreUI \
+    ) \
     -lobjc \
 ))
 
commit 6de586f3d67539535d549fc8d77b5a6a7a25a85c
Author:     Noel Grandin <[email protected]>
AuthorDate: Wed Jun 15 14:08:33 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:22 2022 +0200

    BridgeFactory should be a singleton
    
    regression from
        commit 9be078ae0d4cc4e4c01952bb42c9bb5943bbde86
        Date:   Sat Jul 4 09:12:35 2020 +0200
        binaryurp: create instances with uno constructors
    
    Change-Id: Ib7a7316fdee4afffac35b282adaf437ff8bdd009
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135904
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>
    (cherry picked from commit 7531f027c742a601c13a7a849dfae795a148d899)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135989
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit e04635f338b9a39df0ed62b0909b0ac56c9a5b76)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136030
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/binaryurp/source/binaryurp.component 
b/binaryurp/source/binaryurp.component
index e2581c76411e..b5b0f4da102f 100644
--- a/binaryurp/source/binaryurp.component
+++ b/binaryurp/source/binaryurp.component
@@ -20,7 +20,7 @@
 <component loader="com.sun.star.loader.SharedLibrary" environment="@CPPU_ENV@"
     xmlns="http://openoffice.org/2010/uno-components";>
   <implementation name="com.sun.star.comp.bridge.BridgeFactory"
-        
constructor="com_sun_star_comp_bridge_BridgeFactory_get_implementation">
+        
constructor="com_sun_star_comp_bridge_BridgeFactory_get_implementation" 
single-instance="true">
     <service name="com.sun.star.bridge.BridgeFactory"/>
   </implementation>
 </component>
commit c5bf0e6f5f7a279ec012c4de06d719673da5d6d5
Author:     Mike Kaganski <[email protected]>
AuthorDate: Mon Jun 27 12:02:44 2022 +0300
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:22 2022 +0200

    tdf#126263: do not try to delete non-temporary files
    
    Change-Id: I5df7db7eac6224fce833e6b9d4ea220cade44e4b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136483
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136491
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136506

diff --git a/shell/source/win32/simplemail/senddoc.cxx 
b/shell/source/win32/simplemail/senddoc.cxx
index 3b57684fe821..e34412cbfae1 100644
--- a/shell/source/win32/simplemail/senddoc.cxx
+++ b/shell/source/win32/simplemail/senddoc.cxx
@@ -58,8 +58,8 @@ namespace /* private */
     std::vector<std::wstring> gTo;
     std::vector<std::wstring> gCc;
     std::vector<std::wstring> gBcc;
-    // Keep temp filepath and displayed name
-    std::vector<std::pair<std::wstring, std::wstring>> gAttachments;
+    // Keep temp filepath, displayed name, and "do not delete" flag
+    std::vector<std::tuple<std::wstring, std::wstring, bool>> gAttachments;
     int gMapiFlags = 0;
 }
 
@@ -121,11 +121,12 @@ static void initAttachmentList(MapiAttachmentList_t* 
pMapiAttachmentList)
 {
     OSL_ASSERT(pMapiAttachmentList->empty());
 
-    for (const auto& attachment : gAttachments)
+    for (const auto& [filepath, attachname, nodelete] : gAttachments)
     {
+        (void)nodelete;
         MapiFileDescW mfd;
         ZeroMemory(&mfd, sizeof(mfd));
-        mfd.lpszPathName = const_cast<wchar_t*>(attachment.first.c_str());
+        mfd.lpszPathName = const_cast<wchar_t*>(filepath.c_str());
         // MapiFileDesc documentation 
(https://msdn.microsoft.com/en-us/library/hh707272)
         // allows using here either nullptr, or a pointer to empty string. 
However,
         // for Outlook 2013, we cannot use nullptr here, and must point to a 
(possibly
@@ -134,7 +135,7 @@ static void initAttachmentList(MapiAttachmentList_t* 
pMapiAttachmentList)
         // Since C++11, c_str() must return a pointer to single null character 
when the
         // string is empty, so we are OK here in case when there's no explicit 
file name
         // passed
-        mfd.lpszFileName = const_cast<wchar_t*>(attachment.second.c_str());
+        mfd.lpszFileName = const_cast<wchar_t*>(attachname.c_str());
         mfd.nPosition = sal::static_int_cast<ULONG>(-1);
         pMapiAttachmentList->push_back(mfd);
     }
@@ -239,7 +240,14 @@ static void initParameter(int argc, wchar_t* argv[])
                     sName = argv[i+3];
                     i += 2;
                 }
-                gAttachments.emplace_back(sPath, sName);
+                // Also there may be --nodelete to keep the attachment on exit
+                bool nodelete = false;
+                if ((i + 2) < argc && _wcsicmp(argv[i+2], L"--nodelete") == 0)
+                {
+                    nodelete = true;
+                    ++i;
+                }
+                gAttachments.emplace_back(sPath, sName, nodelete);
             }
             else if (_wcsicmp(argv[i], L"--langtag") == 0)
                 gLangTag = o3tl::toU(argv[i+1]);
@@ -401,8 +409,12 @@ int wmain(int argc, wchar_t* argv[])
     }
 
     // Now cleanup the temporary attachment files
-    for (const auto& rAttachment : gAttachments)
-        DeleteFileW(rAttachment.first.c_str());
+    for (const auto& [filepath, attachname, nodelete] : gAttachments)
+    {
+        (void)attachname;
+        if (!nodelete)
+            DeleteFileW(filepath.c_str());
+    }
 
     // Only show the error message if UI was requested
     if ((ulRet != SUCCESS_SUCCESS) && (gMapiFlags & (MAPI_DIALOG | 
MAPI_LOGON_UI)))
@@ -434,11 +446,13 @@ int wmain(int argc, wchar_t* argv[])
         for (const auto& address : gBcc)
             oss << "--bcc " << address << std::endl;
 
-        for (const auto& attachment : gAttachments)
+        for (const auto& [filepath, attachname, nodelete] : gAttachments)
         {
-            oss << "--attach " << attachment.first << std::endl;
-            if (!attachment.second.empty())
-                oss << "--attach-name " << attachment.second << std::endl;
+            oss << "--attach " << filepath << std::endl;
+            if (!attachname.empty())
+                oss << "--attach-name " << attachname << std::endl;
+            if (nodelete)
+                oss << "--nodelete" << std::endl;
         }
 
         if (gMapiFlags & MAPI_DIALOG)
diff --git a/shell/source/win32/simplemail/smplmailclient.cxx 
b/shell/source/win32/simplemail/smplmailclient.cxx
index 4b19880d6cc2..075eaa34579d 100644
--- a/shell/source/win32/simplemail/smplmailclient.cxx
+++ b/shell/source/win32/simplemail/smplmailclient.cxx
@@ -180,7 +180,8 @@ const OUString& GetBaseTempDirURL()
 }
 }
 
-OUString CSmplMailClient::CopyAttachment(const OUString& sOrigAttachURL, 
OUString& sUserVisibleName)
+OUString CSmplMailClient::CopyAttachment(const OUString& sOrigAttachURL, 
OUString& sUserVisibleName,
+                                         bool& nodelete)
 {
     // We do two things here:
     // 1. Make the attachment temporary filename to not contain any fancy 
characters possible in
@@ -203,6 +204,7 @@ OUString CSmplMailClient::CopyAttachment(const OUString& 
sOrigAttachURL, OUStrin
         INetURLObject url(sOrigAttachURL, 
INetURLObject::EncodeMechanism::WasEncoded);
         sUserVisibleName = url.getName(INetURLObject::LAST_SEGMENT, true,
             INetURLObject::DecodeMechanism::WithCharset);
+        nodelete = false;
     }
     else
     {
@@ -211,6 +213,7 @@ OUString CSmplMailClient::CopyAttachment(const OUString& 
sOrigAttachURL, OUStrin
         // is the absent attachment file anyway.
         sNewAttachmentURL = sOrigAttachURL;
         maAttachmentFiles.pop_back();
+        nodelete = true; // Do not delete a non-temporary in senddoc
     }
     return sNewAttachmentURL;
 }
@@ -298,7 +301,8 @@ void CSmplMailClient::assembleCommandLine(
     for (const auto& attachment : attachments)
     {
         OUString sDisplayName;
-        OUString sTempFileURL(CopyAttachment(attachment, sDisplayName));
+        bool nodelete = false;
+        OUString sTempFileURL(CopyAttachment(attachment, sDisplayName, 
nodelete));
         OUString sysPath;
         osl::FileBase::RC err = 
osl::FileBase::getSystemPathFromFileURL(sTempFileURL, sysPath);
         if (err != osl::FileBase::E_None)
@@ -314,6 +318,8 @@ void CSmplMailClient::assembleCommandLine(
             rCommandArgs.push_back("--attach-name");
             rCommandArgs.push_back(sDisplayName);
         }
+        if (nodelete)
+            rCommandArgs.push_back("--nodelete");
     }
 
     if (!(aFlag & NO_USER_INTERFACE))
diff --git a/shell/source/win32/simplemail/smplmailclient.hxx 
b/shell/source/win32/simplemail/smplmailclient.hxx
index 5844e99147e5..6f71a1a2a715 100644
--- a/shell/source/win32/simplemail/smplmailclient.hxx
+++ b/shell/source/win32/simplemail/smplmailclient.hxx
@@ -38,7 +38,7 @@ public:
 private:
     void validateParameter(const 
css::uno::Reference<css::system::XSimpleMailMessage>& xSimpleMailMessage, 
sal_Int32 aFlag);
     void assembleCommandLine(const 
css::uno::Reference<css::system::XSimpleMailMessage>& xSimpleMailMessage, 
sal_Int32 aFlag, std::vector<OUString>& rCommandArgs);
-    OUString CopyAttachment(const OUString& sOrigAttachURL, OUString& 
sUserVisibleName);
+    OUString CopyAttachment(const OUString& sOrigAttachURL, OUString& 
sUserVisibleName, bool& nodelete);
     // Don't try to delete the copied attachment files; let the spawned 
process cleanup them
     void ReleaseAttachments();
 
commit 0da1e66fe0010f3dfbfd9144bab9b5790429a222
Author:     Mike Kaganski <[email protected]>
AuthorDate: Mon Jun 27 10:24:28 2022 +0300
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:21 2022 +0200

    tdf#126263: make sure to convert system path to file URLs
    
    Change-Id: Ia21f29e3a1eb078a7df2366399c59d46ab26ff3a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136482
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136490
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136505

diff --git a/shell/source/win32/simplemail/smplmailclient.cxx 
b/shell/source/win32/simplemail/smplmailclient.cxx
index 1396bd150066..4b19880d6cc2 100644
--- a/shell/source/win32/simplemail/smplmailclient.cxx
+++ b/shell/source/win32/simplemail/smplmailclient.cxx
@@ -194,7 +194,11 @@ OUString CSmplMailClient::CopyAttachment(const OUString& 
sOrigAttachURL, OUStrin
     maAttachmentFiles.back()->EnableKillingFile();
     INetURLObject aFilePathObj(maAttachmentFiles.back()->GetURL());
     OUString sNewAttachmentURL = 
aFilePathObj.GetMainURL(INetURLObject::DecodeMechanism::NONE);
-    if (osl::File::copy(sOrigAttachURL, sNewAttachmentURL) == 
osl::FileBase::RC::E_None)
+    OUString sCorrectedOrigAttachURL(sOrigAttachURL);
+    // Make sure to convert to URL, if a system path was passed to 
XSimpleMailMessage
+    // Ignore conversion error, in which case sCorrectedOrigAttachURL is 
unchanged
+    osl::FileBase::getFileURLFromSystemPath(sCorrectedOrigAttachURL, 
sCorrectedOrigAttachURL);
+    if (osl::File::copy(sCorrectedOrigAttachURL, sNewAttachmentURL) == 
osl::FileBase::RC::E_None)
     {
         INetURLObject url(sOrigAttachURL, 
INetURLObject::EncodeMechanism::WasEncoded);
         sUserVisibleName = url.getName(INetURLObject::LAST_SEGMENT, true,
commit c32605e54a4525c5ad80e273f17e657e9e601b13
Author:     Mike Kaganski <[email protected]>
AuthorDate: Mon Jun 27 15:29:25 2022 +0300
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:21 2022 +0200

    Integer division could cancel small values of wrong sign
    
    ... as seen at some documents where the values are like -1. There
    the checks in pushToPropMap may pass (the division result would be 0),
    but the original small negative values would fail the asserts that
    were introduced in commit 5772cef244dbee5834efbc693bc714d89ae6301d
      Author Mike Kaganski <[email protected]>
      Date   Wed Jun 15 18:33:38 2022 +0300
        tdf#134210: Reimplement cropping from srcRect and fillRect
    
    Change-Id: I114588862b5cfd2b2e4491424430cc139bdbaae9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136492
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 2d9f3c066a065d6aa98f1e594dcf8a091fec2bde)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136471
    Reviewed-by: Xisco Fauli <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136556

diff --git a/oox/source/drawingml/fillproperties.cxx 
b/oox/source/drawingml/fillproperties.cxx
index ecf717d99f4a..a678524035b9 100644
--- a/oox/source/drawingml/fillproperties.cxx
+++ b/oox/source/drawingml/fillproperties.cxx
@@ -97,8 +97,10 @@ Quotients getQuotients(geometry::IntegerRectangle2D 
aRelRect, double hDiv, doubl
 // ECMA-376 Part 1 20.1.8.55 srcRect (Source Rectangle)
 std::optional<Quotients> CropQuotientsFromSrcRect(geometry::IntegerRectangle2D 
aSrcRect)
 {
-    // Currently the following precondition is guaranteed in 
GraphicProperties::pushToPropMap
-    assert(aSrcRect.X1 >= 0 && aSrcRect.X2 >= 0 && aSrcRect.Y1 >= 0 && 
aSrcRect.Y2 >= 0);
+    aSrcRect.X1 = std::max(aSrcRect.X1, sal_Int32(0));
+    aSrcRect.X2 = std::max(aSrcRect.X2, sal_Int32(0));
+    aSrcRect.Y1 = std::max(aSrcRect.Y1, sal_Int32(0));
+    aSrcRect.Y2 = std::max(aSrcRect.Y2, sal_Int32(0));
     if (aSrcRect.X1 + aSrcRect.X2 >= 100'000 || aSrcRect.Y1 + aSrcRect.Y2 >= 
100'000)
         return {}; // Cropped everything
     return getQuotients(aSrcRect, 100'000.0, 100'000.0);
@@ -107,8 +109,10 @@ std::optional<Quotients> 
CropQuotientsFromSrcRect(geometry::IntegerRectangle2D a
 // ECMA-376 Part 1 20.1.8.30 fillRect (Fill Rectangle)
 std::optional<Quotients> 
CropQuotientsFromFillRect(geometry::IntegerRectangle2D aFillRect)
 {
-    // Currently the following precondition is guaranteed in 
FillProperties::pushToPropMap
-    assert(aFillRect.X1 <= 0 && aFillRect.X2 <= 0 && aFillRect.Y1 <= 0 && 
aFillRect.Y2 <= 0);
+    aFillRect.X1 = std::min(aFillRect.X1, sal_Int32(0));
+    aFillRect.X2 = std::min(aFillRect.X2, sal_Int32(0));
+    aFillRect.Y1 = std::min(aFillRect.Y1, sal_Int32(0));
+    aFillRect.Y2 = std::min(aFillRect.Y2, sal_Int32(0));
     // Negative divisor and negative relative offset give positive value 
wanted in lclCropGraphic
     return getQuotients(aFillRect, -100'000.0 + aFillRect.X1 + aFillRect.X2,
                         -100'000.0 + aFillRect.Y1 + aFillRect.Y2);
diff --git a/sd/qa/unit/data/pptx/croppedTo0.pptx 
b/sd/qa/unit/data/pptx/croppedTo0.pptx
index fecf53559b1f..081661f48601 100644
Binary files a/sd/qa/unit/data/pptx/croppedTo0.pptx and 
b/sd/qa/unit/data/pptx/croppedTo0.pptx differ
diff --git a/sd/qa/unit/import-tests2.cxx b/sd/qa/unit/import-tests2.cxx
index 29ef8d7c3ce9..142599fa945d 100644
--- a/sd/qa/unit/import-tests2.cxx
+++ b/sd/qa/unit/import-tests2.cxx
@@ -1996,6 +1996,7 @@ void SdImportTest2::testDefaultTabStop()
 void SdImportTest2::testCropToZero()
 {
     // Must not crash because of division by zero
+    // Also must not fail assertions because of passing negative value to 
CropQuotientsFromSrcRect
     
loadURL(m_directories.getURLFromSrc(u"/sd/qa/unit/data/pptx/croppedTo0.pptx"), 
PPTX);
 }
 
commit 5194c946d80426d2cfe8ce9fb093c50722793c4b
Author:     Mike Kaganski <[email protected]>
AuthorDate: Wed Jun 15 18:33:38 2022 +0300
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:21 2022 +0200

    tdf#134210: Reimplement cropping from srcRect and fillRect
    
    This avoids the scaling after the crop, since scaling is performed
    anyway when applying BitmapMode_STRETCH. This improves resulting
    bitmap quality.
    
    Also consider the "crop to zero" case (when the sum of cropped
    parts is equal to 100%). In that case, just use an empty graphic
    as the fill bitmap.
    
    This makes the differences between srcRect and fillRect processing
    explicit, simplifies the code, avoids extra rounding inaccuracies,
    and takes care of the edge cases that were considered in commit
    2859ec288f2c1323ea3123d82cb1684b349ff598
      Author Miklos Vajna <[email protected]>
      Date   Wed Jun 15 15:52:18 2022 +0200
        oox: fix div by zero in lclCalculateCropPercentage()
    
    The change in SdImportTest2::testTdf134210 is because we now don't
    scale the cropped image. The previous value was an interpolated
    color, while the new value is the actual color of pixel [0, 41] of
    the original image.
    
    Change-Id: I24fa9928cff32bcaa6a7b3e34def14700fddd7ca
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135917
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <[email protected]>
    (cherry picked from commit 5772cef244dbee5834efbc693bc714d89ae6301d)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136038
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit c7a21bfed044154cac23328d37b46f34aeda0709)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136155

diff --git a/oox/source/drawingml/fillproperties.cxx 
b/oox/source/drawingml/fillproperties.cxx
index 9a39a475ca6c..ecf717d99f4a 100644
--- a/oox/source/drawingml/fillproperties.cxx
+++ b/oox/source/drawingml/fillproperties.cxx
@@ -88,67 +88,55 @@ Reference< XGraphic > 
lclRotateGraphic(uno::Reference<graphic::XGraphic> const &
     return aReturnGraphic.GetXGraphic();
 }
 
-void lclCalculateCropPercentage(uno::Reference<graphic::XGraphic> const & 
xGraphic, geometry::IntegerRectangle2D &aFillRect)
+using Quotients = std::tuple<double, double, double, double>;
+Quotients getQuotients(geometry::IntegerRectangle2D aRelRect, double hDiv, 
double vDiv)
 {
-    ::Graphic aGraphic(xGraphic);
-    assert (aGraphic.GetType() == GraphicType::Bitmap);
-
-    BitmapEx aBitmapEx(aGraphic.GetBitmapEx());
-
-    sal_Int32 nScaledWidth = aBitmapEx.GetSizePixel().Width();
-    sal_Int32 nScaledHeight = aBitmapEx.GetSizePixel().Height();
-
-    sal_Int32 nOrigWidth = (nScaledWidth * (100000 - aFillRect.X1 - 
aFillRect.X2)) / 100000;
-    if (nOrigWidth == 0)
-    {
-        nOrigWidth = 1;
-    }
-    sal_Int32 nOrigHeight = (nScaledHeight * (100000 - aFillRect.Y1 - 
aFillRect.Y2)) / 100000;
-    if (nOrigHeight == 0)
-    {
-        nOrigHeight = 1;
-    }
+    return { aRelRect.X1 / hDiv, aRelRect.Y1 / vDiv, aRelRect.X2 / hDiv, 
aRelRect.Y2 / vDiv };
+}
 
-    sal_Int32 nLeftPercentage = nScaledWidth * aFillRect.X1 / nOrigWidth;
-    sal_Int32 nRightPercentage = nScaledWidth * aFillRect.X2 / nOrigWidth;
-    sal_Int32 nTopPercentage = nScaledHeight * aFillRect.Y1 / nOrigHeight;
-    sal_Int32 nBottomPercentage = nScaledHeight * aFillRect.Y2 / nOrigHeight;
+// ECMA-376 Part 1 20.1.8.55 srcRect (Source Rectangle)
+std::optional<Quotients> CropQuotientsFromSrcRect(geometry::IntegerRectangle2D 
aSrcRect)
+{
+    // Currently the following precondition is guaranteed in 
GraphicProperties::pushToPropMap
+    assert(aSrcRect.X1 >= 0 && aSrcRect.X2 >= 0 && aSrcRect.Y1 >= 0 && 
aSrcRect.Y2 >= 0);
+    if (aSrcRect.X1 + aSrcRect.X2 >= 100'000 || aSrcRect.Y1 + aSrcRect.Y2 >= 
100'000)
+        return {}; // Cropped everything
+    return getQuotients(aSrcRect, 100'000.0, 100'000.0);
+}
 
-    aFillRect.X1 = -nLeftPercentage;
-    aFillRect.X2 = -nRightPercentage;
-    aFillRect.Y1 = -nTopPercentage;
-    aFillRect.Y2 = -nBottomPercentage;
+// ECMA-376 Part 1 20.1.8.30 fillRect (Fill Rectangle)
+std::optional<Quotients> 
CropQuotientsFromFillRect(geometry::IntegerRectangle2D aFillRect)
+{
+    // Currently the following precondition is guaranteed in 
FillProperties::pushToPropMap
+    assert(aFillRect.X1 <= 0 && aFillRect.X2 <= 0 && aFillRect.Y1 <= 0 && 
aFillRect.Y2 <= 0);
+    // Negative divisor and negative relative offset give positive value 
wanted in lclCropGraphic
+    return getQuotients(aFillRect, -100'000.0 + aFillRect.X1 + aFillRect.X2,
+                        -100'000.0 + aFillRect.Y1 + aFillRect.Y2);
 }
 
-// Crops a piece of the bitmap. Takes negative aFillRect values. Negative 
values means "crop",
-// positive values means "grow" bitmap with empty spaces. lclCropGraphic 
doesn't handle growing.
-Reference< XGraphic > lclCropGraphic(uno::Reference<graphic::XGraphic> const & 
xGraphic, geometry::IntegerRectangle2D aFillRect)
+// Crops a piece of the bitmap. lclCropGraphic doesn't handle growing.
+Reference<XGraphic> lclCropGraphic(uno::Reference<graphic::XGraphic> const& 
xGraphic,
+                                   std::optional<Quotients> quotients)
 {
     ::Graphic aGraphic(xGraphic);
-    ::Graphic aReturnGraphic;
-
     assert (aGraphic.GetType() == GraphicType::Bitmap);
 
-    BitmapEx aBitmapEx(aGraphic.GetBitmapEx());
-
-    sal_Int32 nOrigHeight = aBitmapEx.GetSizePixel().Height();
-    sal_Int32 nHeight = nOrigHeight;
-    sal_Int32 nTopCorr  = nOrigHeight * -1 * static_cast<double>(aFillRect.Y1) 
/ 100000;
-    nHeight += nTopCorr;
-    sal_Int32 nBottomCorr = nOrigHeight * -1 * 
static_cast<double>(aFillRect.Y2) / 100000;
-    nHeight += nBottomCorr;
+    BitmapEx aBitmapEx;
+    if (quotients)
+    {
+        aBitmapEx = aGraphic.GetBitmapEx();
 
-    sal_Int32 nOrigWidth = aBitmapEx.GetSizePixel().Width();
-    sal_Int32 nWidth = nOrigWidth;
-    sal_Int32 nLeftCorr  = nOrigWidth * -1 * static_cast<double>(aFillRect.X1) 
/ 100000;
-    nWidth += nLeftCorr;
-    sal_Int32 nRightCorr = nOrigWidth * -1 * static_cast<double>(aFillRect.X2) 
/ 100000;
-    nWidth += nRightCorr;
+        const Size bmpSize = aBitmapEx.GetSizePixel();
+        const auto& [qx1, qy1, qx2, qy2] = *quotients;
+        const tools::Long l = std::round(bmpSize.Width() * qx1);
+        const tools::Long t = std::round(bmpSize.Height() * qy1);
+        const tools::Long r = std::round(bmpSize.Width() * qx2);
+        const tools::Long b = std::round(bmpSize.Height() * qy2);
 
-    aBitmapEx.Scale(Size(nWidth, nHeight));
-    aBitmapEx.Crop(tools::Rectangle(Point(nLeftCorr, nTopCorr), 
Size(nOrigWidth, nOrigHeight)));
+        aBitmapEx.Crop({ l, t, bmpSize.Width() - r - 1, bmpSize.Height() - b - 
1 });
+    }
 
-    aReturnGraphic = ::Graphic(aBitmapEx);
+    ::Graphic aReturnGraphic(aBitmapEx);
     aReturnGraphic.setOriginURL(aGraphic.getOriginURL());
 
     return aReturnGraphic.GetXGraphic();
@@ -812,7 +800,7 @@ void FillProperties::pushToPropMap( ShapePropertyMap& 
rPropMap,
 
                             if(bIsCustomShape && bHasCropValues && bNeedCrop)
                             {
-                                xGraphic = lclCropGraphic(xGraphic, aFillRect);
+                                xGraphic = lclCropGraphic(xGraphic, 
CropQuotientsFromFillRect(aFillRect));
                                 
rPropMap.setProperty(ShapeProperty::FillBitmap, xGraphic);
                             }
                         }
@@ -926,9 +914,7 @@ void GraphicProperties::pushToPropMap( PropertyMap& 
rPropMap, const GraphicHelpe
 
                 if(mbIsCustomShape && bHasCropValues && bNeedCrop)
                 {
-                    geometry::IntegerRectangle2D aCropRect = oClipRect;
-                    lclCalculateCropPercentage(xGraphic, aCropRect);
-                    xGraphic = lclCropGraphic(xGraphic, aCropRect);
+                    xGraphic = lclCropGraphic(xGraphic, 
CropQuotientsFromSrcRect(oClipRect));
                 }
             }
         }
diff --git a/sd/qa/unit/data/pptx/croppedTo0.pptx 
b/sd/qa/unit/data/pptx/croppedTo0.pptx
new file mode 100644
index 000000000000..fecf53559b1f
Binary files /dev/null and b/sd/qa/unit/data/pptx/croppedTo0.pptx differ
diff --git a/sd/qa/unit/import-tests2.cxx b/sd/qa/unit/import-tests2.cxx
index ee0d110df24d..29ef8d7c3ce9 100644
--- a/sd/qa/unit/import-tests2.cxx
+++ b/sd/qa/unit/import-tests2.cxx
@@ -174,6 +174,7 @@ public:
     void testHyperlinksOnShapes();
     void testTdf112209();
     void testDefaultTabStop();
+    void testCropToZero();
 
     CPPUNIT_TEST_SUITE(SdImportTest2);
 
@@ -240,6 +241,7 @@ public:
     CPPUNIT_TEST(testHyperlinksOnShapes);
     CPPUNIT_TEST(testTdf112209);
     CPPUNIT_TEST(testDefaultTabStop);
+    CPPUNIT_TEST(testCropToZero);
 
     CPPUNIT_TEST_SUITE_END();
 };
@@ -1281,7 +1283,7 @@ void SdImportTest2::testTdf134210()
 
     Graphic aGraphic(xGraphic);
     BitmapEx aBitmap(aGraphic.GetBitmapEx());
-    CPPUNIT_ASSERT_EQUAL(Color(0x60563e), aBitmap.GetPixelColor(0, 0));
+    CPPUNIT_ASSERT_EQUAL(Color(0x605741), aBitmap.GetPixelColor(0, 0));
 
     xDocShRef->DoClose();
 }
@@ -1991,6 +1993,12 @@ void SdImportTest2::testDefaultTabStop()
     xDocShRef->DoClose();
 }
 
+void SdImportTest2::testCropToZero()
+{
+    // Must not crash because of division by zero
+    
loadURL(m_directories.getURLFromSrc(u"/sd/qa/unit/data/pptx/croppedTo0.pptx"), 
PPTX);
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(SdImportTest2);
 
 CPPUNIT_PLUGIN_IMPLEMENT();
commit 9c9911bcf882f1da5943cbadfba5498406bb7438
Author:     Noel Grandin <[email protected]>
AuthorDate: Mon Jun 27 16:30:19 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 16:04:21 2022 +0200

    tdf#149692 crash importing document with vba forms
    
    This bug appears to date back to
        commit a43cc9ec8dde4f311bcf8ff96e6a26d56b2abdcf
        Author: Noel Power <[email protected]>
        Date:   Wed Apr 17 17:08:59 2013 +0100
        implement MultiPage, Page & TabStrip import for oox
    
    Change-Id: Ia4784e4c34189f05e516704fa2e2485e4560fa4b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136500
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>
    (cherry picked from commit a15fe37bf1dc50fcf88cea9c0038b217119671b8)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136472
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit ef79ccd5bbd5fbc0f0c132c4fc5a48fcd1fbbc16)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136535
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/oox/source/ole/vbacontrol.cxx b/oox/source/ole/vbacontrol.cxx
index 88d7f28617ef..9c2a301635d9 100644
--- a/oox/source/ole/vbacontrol.cxx
+++ b/oox/source/ole/vbacontrol.cxx
@@ -446,13 +446,17 @@ void VbaFormControl::importStorage( StorageBase& rStrg, 
const AxClassTable& rCla
                 if ( xPageSiteRef )
                     idToPage[ xPageSiteRef->getId() ] = control;
             }
-            else
+            else if (elem->getControlType() == API_CONTROL_TABSTRIP)
             {
                 AxTabStripModel* pTabStrip = 
static_cast<AxTabStripModel*>(elem.get());
                 sCaptions = pTabStrip->maItems;
                 pMultiPage->mnActiveTab = pTabStrip->mnListIndex;
                 pMultiPage->mnTabStyle = pTabStrip->mnTabStyle;
             }
+            else
+            {
+                SAL_WARN("oox", "unexpected control type " << 
elem->getControlType());
+            }
         }
         // apply caption/titles to pages
 
commit 523f76ff8ce0f2b5a0d7653bc1066a5522dedd95
Author:     Caolán McNamara <[email protected]>
AuthorDate: Mon Jun 27 14:28:58 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 15:59:45 2022 +0200

    sw: avoid divide by zero in SwTextGridPage::CharorLineChangedHdl
    
    See 
https://crashreport.libreoffice.org/stats/signature/SwTextGridPage::CharorLineChangedHdl(weld::SpinButton%20&)
    
    disable the offending widget if the value is zero.
    
    crash reproducible under gen with CJK features enabled by: format, page
    style, text grid, grid (lines and characters), max base text size of
    1000 and then click in "characters per line" and then click in "lines
    per page".
    
    Change-Id: Ic0f8131955ab01412dd54bdd5d3bffe518938fb5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136470
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/sw/source/ui/misc/pggrid.cxx b/sw/source/ui/misc/pggrid.cxx
index 875bee7ad331..46f78140a927 100644
--- a/sw/source/ui/misc/pggrid.cxx
+++ b/sw/source/ui/misc/pggrid.cxx
@@ -318,10 +318,13 @@ void SwTextGridPage::UpdatePageSize(const SfxItemSet& 
rSet)
     {
         sal_Int32 nCharsPerLine = m_aPageSize.Width() / nTextSize;
         m_xCharsPerLineNF->set_max(nCharsPerLine);
+        m_xCharsPerLineNF->set_sensitive(nCharsPerLine != 0);
         m_xCharsPerLineNF->set_value(nCharsPerLine);
-        m_xLinesPerPageNF->set_max(m_aPageSize.Height() /
+        sal_Int32 nMaxLines = m_aPageSize.Height() /
         (   
m_xTextSizeMF->denormalize(m_xTextSizeMF->get_value(FieldUnit::TWIP)) +
-                    
m_xRubySizeMF->denormalize(m_xRubySizeMF->get_value(FieldUnit::TWIP))));
+                    
m_xRubySizeMF->denormalize(m_xRubySizeMF->get_value(FieldUnit::TWIP)));
+        m_xLinesPerPageNF->set_max(nMaxLines);
+        m_xLinesPerPageNF->set_sensitive(nMaxLines != 0);
         SetLinesOrCharsRanges( *m_xCharsRangeFT , m_xCharsPerLineNF->get_max() 
);
         SetLinesOrCharsRanges( *m_xLinesRangeFT , m_xLinesPerPageNF->get_max() 
);
     }
@@ -371,6 +374,7 @@ IMPL_LINK(SwTextGridPage, CharorLineChangedHdl, 
weld::SpinButton&, rField, void)
                 (   
m_xTextSizeMF->denormalize(m_xTextSizeMF->get_value(FieldUnit::TWIP)) +
                     
m_xRubySizeMF->denormalize(m_xRubySizeMF->get_value(FieldUnit::TWIP))));
             m_xLinesPerPageNF->set_max(nMaxLines);
+            m_xLinesPerPageNF->set_sensitive(nMaxLines != 0);
         }
         SetLinesOrCharsRanges( *m_xLinesRangeFT , m_xLinesPerPageNF->get_max() 
);
         SetLinesOrCharsRanges( *m_xCharsRangeFT , m_xCharsPerLineNF->get_max() 
);
@@ -417,6 +421,7 @@ IMPL_LINK(SwTextGridPage, TextSizeChangedHdl, 
weld::MetricSpinButton&, rField, v
                 sal_Int32 nMaxChars = m_aPageSize.Width() / nTextSize;
                 m_xCharsPerLineNF->set_value(nMaxChars);
                 m_xCharsPerLineNF->set_max(nMaxChars);
+                m_xCharsPerLineNF->set_sensitive(nMaxChars != 0);
                 SetLinesOrCharsRanges( *m_xCharsRangeFT , 
m_xCharsPerLineNF->get_max() );
             }
         }
@@ -426,6 +431,7 @@ IMPL_LINK(SwTextGridPage, TextSizeChangedHdl, 
weld::MetricSpinButton&, rField, v
                 (   
m_xTextSizeMF->denormalize(m_xTextSizeMF->get_value(FieldUnit::TWIP)) +
                     
m_xRubySizeMF->denormalize(m_xRubySizeMF->get_value(FieldUnit::TWIP))));
             m_xLinesPerPageNF->set_max(nMaxLines);
+            m_xLinesPerPageNF->set_sensitive(nMaxLines != 0);
             SetLinesOrCharsRanges( *m_xLinesRangeFT , 
m_xLinesPerPageNF->get_max() );
         }
     }
commit b1e29e67397d5e94ef23b94a9bceb879c03b027a
Author:     Andras Timar <[email protected]>
AuthorDate: Thu Jun 30 18:31:14 2022 +0200
Commit:     Andras Timar <[email protected]>
CommitDate: Sat Jul 2 15:58:28 2022 +0200

    LOK: Allow image upload from WOPI-like host with self-signed cert
    
    Change-Id: I28a7de489b06fd5a993b82bb39274eb6f0c373ce

diff --git a/ucb/source/ucp/webdav-curl/CurlSession.cxx 
b/ucb/source/ucp/webdav-curl/CurlSession.cxx
index ef3241f1c3dc..7d56dfebd3e4 100644
--- a/ucb/source/ucp/webdav-curl/CurlSession.cxx
+++ b/ucb/source/ucp/webdav-curl/CurlSession.cxx
@@ -15,6 +15,7 @@
 #include "webdavresponseparser.hxx"
 
 #include <comphelper/attributelist.hxx>
+#include <comphelper/lok.hxx>
 #include <comphelper/scopeguard.hxx>
 #include <comphelper/string.hxx>
 
@@ -709,6 +710,14 @@ 
CurlSession::CurlSession(uno::Reference<uno::XComponentContext> const& xContext,
         rc = curl_easy_setopt(m_pCurl.get(), CURLOPT_FORBID_REUSE, 1L);
         assert(rc == CURLE_OK);
     }
+    // If WOPI-like host has self-signed certificate, it's not possible to 
insert images
+    // to the document, so here is a compromise. The user has already accepted 
the self
+    // signed certificate in the browser, when we get here.
+    if (comphelper::LibreOfficeKit::isActive())
+    {
+        rc = curl_easy_setopt(m_pCurl.get(), CURLOPT_SSL_VERIFYPEER, 0L);
+        assert(rc == CURLE_OK);
+    }
 }
 
 CurlSession::~CurlSession() {}

Reply via email to