Closed martonmiklos closed 9 months ago
Yes, I also wondered once, if there is better way to handle this code line embedded in a text string.
For security reasons and to ease the translations.
Can you please explain this a bit, specifically the security aspect. I perceived it just as a small nuisance ("a bit ugly"), hence I did not mind to research and address this.
I would recommend to make the command untranslatable by adding a placeholder to it.
I know there is a notranslate
tag, but have no idea, if this is the right thing to use and how.
As always, PRs are welcome, then I might also understand better what solution you think of and how that looks like in practice. Side note: I am merely little experienced with Qt's l10n infrastructure.
Can you please explain this a bit, specifically the security aspect.
Well if I 'mis-translate' this string to end with an rm -rf / there could be an issue if someone copies it over and execute it.
I know there is a notranslate tag, but have no idea, if this is the right thing to use and how.
I am not an expert on the localization, but I would use the qsTr somehow like this:
qsTr("The SailfishOS:Chum GUI application failed to manage the SailfishOS:Chum repository! "
"You probably have multiple SailfishOS:Chum repositories defined for SSU or disabled a "
"SailfishOS:Chum repository.\n\n"
"Please remove all SailfishOS:Chum repositories by executing this command line as root user:\n"
"%s\n"
"This SailfishOS:Chum GUI application will add any missing SailfishOS:Chum repository when started again.").arg("for i in $(ssu lr | fgrep chum | cut -f 3 -d ' '); do ssu rr $i; done");
I do no have SFOS SDK at hand at the moment, but I will submit a PR once get back to my dev box.
Can you please explain this a bit, specifically the security aspect.
Well, if one "mis-translates" this string to end with an
rm -rf /
there could be an issue if someone copies it over and executes it.
So this is about safety (not security), nevertheless the reasoning is valid. :+1:
@martonmiklos, as your idea for rendering the shell code as immutable for translators is not ID-based, your implementation suggestion has to be transformed to suite ID-based, translatable Qt strings, first.
Should be fixed by PR #215.
PR #215 seems to work fine, but by looking at this text I realise to have never seen it before. Thus I played bit with it and lastly created PR #253.
<Screenshots are missing, as one wold have to misconfigure SSU's SailfishOS:Chum repository entry for that. If someone wants to provide corresponding screenshots, please post them here.>
Hi folks,
I came across this string during translation: https://github.com/sailfishos-chum/sailfishos-chum-gui/blob/5d0ce0aa0d7b1c80f88a216d367cd6676aa3c839/src/chum.cpp#L334
I would recommend to make the command untranslatable by adding a placeholder to it. For security reasons and to ease the translations. What do you think?