monzero-gui.git/src, branch mainMonzero desktop wallet graphical interface.
https://code.monzero.org/monzero-gui.git/atom?h=main2026-08-15T20:26:40ZEstablish Monzero GUI Phase 0 baseline2026-08-15T20:26:40ZMonzero Build Systembuilds@monzero.org2026-08-15T20:26:40Zurn:sha1:dceeb88444ce966caa1a133d2926d5f7213c87ffSet desktop file name for the application2026-07-02T06:31:19ZBalló Györgyballogyor@gmail.com2026-07-02T06:20:18Zurn:sha1:db73360ec68a615564a73fd1ee2e7bf7f3491494
This ensures that the XDG toplevel app ID matches with the desktop file
name, so Wayland compositors could match the window with the application
and show the appropriate icon for them.
p2pool v4.17.12026-06-28T10:37:24ZSChernykh15806605+SChernykh@users.noreply.github.com2026-06-28T10:37:24Zurn:sha1:f4bfb444f26c51c5073e00329ee7529468ab0573wizard: check wallet file directory is writeable2026-06-25T16:03:55Zplowsofplowsof@protonmail.com2026-06-25T12:14:09Zurn:sha1:123433dd2caf7f5899c760e172dffb68df3375a7p2pool v4.172026-06-21T17:36:21ZSChernykh15806605+SChernykh@users.noreply.github.com2026-06-21T17:36:21Zurn:sha1:b3e9423780b0fa648dd3d0f7cb4d97ff70a34376TransactionHistory: prevent CSV formula injection in writeCSV2026-06-18T14:29:34ZThomasthomas.giudici@proton.me2026-06-18T10:17:18Zurn:sha1:0fbb1716fba3847a7d6f60287d20c1d9f03489cf
writeCSV wrote the transaction note and subaddress label into the CSV
stripping only the quote character. A cell beginning with =, +, - or @
can be interpreted as a formula by spreadsheet software on open, which
CSV quoting does not prevent.
The transaction note can be attacker-controlled: a payment request's
tx_description is stored as the note when the payment is sent, so a
crafted note can run a spreadsheet formula when the user later exports
and opens their history, potentially enabling data exfiltration or
command execution.
Prefix affected fields with a single quote so they are treated as text;
fields beginning with whitespace or a control character are prefixed too.
Co-authored-by: selsta <selsta@sent.at>
Merge pull request #46022026-06-17T18:42:20Ztobtohttob@featherwallet.org2026-06-17T18:42:20Zurn:sha1:a003cb75b6416488d0a448198e6de03211ae1a67
1627661 libwalletqt: capture background sync password by value (selsta)
ACKs: plowsof
Merge pull request #46032026-06-17T18:41:38Ztobtohttob@featherwallet.org2026-06-17T18:41:38Zurn:sha1:fdecbd3ec5e928143e5f61c141fbfadfa29dcb27
bfce02b libwalletqt: start wallet refresh worker lazily (selsta)
ACKs: plowsof
Merge pull request #45962026-06-15T17:39:40Ztobtohttob@featherwallet.org2026-06-15T17:39:40Zurn:sha1:0a6ba55c69d4ba748865a530bcda5045d5599f24
082cf9a network: require SSL for HTTPS requests (selsta)
ACKs: plowsof
Merge pull request #45972026-06-15T14:41:50Ztobtohttob@featherwallet.org2026-06-15T14:41:50Zurn:sha1:af56df631270447027b341698e4a3309d8ea2f4e
be9eade QR: skip QImage padding when filling quirc buffer (selsta)
ACKs: plowsof