monzero-gui.git/pages/settings, branch monzero-gui-phase0-20260815Monzero desktop wallet graphical interface.
https://code.monzero.org/monzero-gui.git/atom?h=monzero-gui-phase0-202608152026-08-15T20:26:40ZEstablish Monzero GUI Phase 0 baseline2026-08-15T20:26:40ZMonzero Build Systembuilds@monzero.org2026-08-15T20:26:40Zurn:sha1:dceeb88444ce966caa1a133d2926d5f7213c87ffqml: escape untrusted text in remaining RichText views2026-06-18T12:17:25ZThomasthomas.giudici@proton.me2026-06-18T11:34:27Zurn:sha1:3d3a391ef43b1ac09160f4d572d5fbf85f249dc8
Extends the escaping from commit 23ec5eb6 to the RichText sinks it did
not cover: the transaction note in the tx details popup (History), the
wallet name and account label in the send confirmation
(TxConfirmationDialog), the address label on the merchant page
(Merchant), and the wallet path on the info page (SettingsInfo). These
were interpolated unescaped, so a value containing markup is rendered as
rich text.
The transaction note is the notable case: it can be set from a payment
request's tx_description, so it is attacker influenced.
Escape these fields with Utils.htmlEscape. Set the send confirmation
From field to Text.RichText explicitly so the escaped entities decode in
both of its branches; the single-account branch contains no tag and
would otherwise render as plain text and show the raw entity.
qml: escape untrusted text in RichText views2026-04-17T16:02:58Zselstaselsta@sent.at2026-04-17T16:02:58Zurn:sha1:23ec5eb6a1dc61ef72a3ca4c9bb5942cbf60d959Implement background sync when locked2025-08-03T17:26:11Zj-bermanjustinberman@protonmail.com2023-11-17T00:38:52Zurn:sha1:5332495c2404ab4b102c98c22419e70143b1dc90Update year in Cypyright2024-01-27T19:12:09Zinson175314629+inson1@users.noreply.github.com2024-01-27T19:12:09Zurn:sha1:8851e71a8beafb5297be46dbb4d6884aa87bcdd5Merge pull request #40512023-09-30T22:34:24Zluigi1111luigi1111w@gmail.com2023-09-30T22:34:24Zurn:sha1:588b8435b7ab32479f644a3d1b9b4af3028f8a05
1215a6e Assume untrusted daemon in simple mode (j-berman)
499c2a4 qsTr scan tx error (j-berman)
3b0e66a Display clear error when user scans older tx via untrusted daemon (j-berman)
4cd6652 Update balance after calling scan_tx (j-berman)
Merge pull request #40472022-12-02T05:42:04Zluigi1111luigi1111w@gmail.com2022-12-02T05:42:04Zurn:sha1:ef2e711e15b4765e128ca7abddf87f194c6d755a
80ade41 DaemonManager: take dataDir into account when sending cmd (selsta)
qsTr scan tx error2022-10-29T19:22:37Zj-bermanjustinberman@protonmail.com2022-10-29T19:22:37Zurn:sha1:499c2a47fcf0aac6698a35ea30907f381c459776Display clear error when user scans older tx via untrusted daemon2022-10-28T21:14:31Zj-bermanjustinberman@protonmail.com2022-10-28T21:14:31Zurn:sha1:3b0e66a3d08959c267670e832a87bdada3a91335Update balance after calling scan_tx2022-10-20T21:23:10Zj-bermanjustinberman@protonmail.com2022-10-20T21:23:10Zurn:sha1:4cd6652825972a32f18881a88e01681830fa0577