aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Point GUI at sibling Monzero core repositoryHEADmonzero-gui-phase0-20260815-r1mainMonzero Build System2 hours1-1/+1
|
* Establish Monzero GUI Phase 0 baselinemonzero-gui-phase0-20260815Monzero Build System2 hours120-1784/+1785
|
* Merge pull request #4626tobtoht2026-07-034-5/+5
|\ | | | | | | | | | | 9c76f09 build: prepare v0.18.5.1 (selsta) ACKs: plowsof
| * build: prepare v0.18.5.1selsta2026-07-034-5/+5
| |
* | Merge pull request #4625tobtoht2026-07-021-0/+1
|\ \ | | | | | | | | | | | | | | | db73360 Set desktop file name for the application (Balló György) ACKs: selsta
| * | Set desktop file name for the applicationBalló György2026-07-021-0/+1
| |/ | | | | | | | | | | This ensures that the XDG toplevel app ID matches with the desktop file name, so Wayland compositors could match the window with the application and show the appropriate icon for them.
* | Merge pull request #4623tobtoht2026-07-021-1/+1
|\ \ | |/ |/| | | | | | | 8290f5a main: hide update popup during device passphrase prompt (selsta) ACKs: plowsof
| * main: hide update popup during device passphrase promptselsta2026-07-011-1/+1
| |
* | Merge pull request #4618tobtoht2026-07-013-0/+54
|\ \ | | | | | | | | | | | | | | | 23930cb Transfer, AddressBook: confirm unauthenticated OpenAlias (selsta) ACKs: plowsof
| * | Transfer, AddressBook: confirm unauthenticated OpenAliasselsta2026-06-263-0/+54
| |/
* | Merge pull request #4590tobtoht2026-06-301-1/+1
|\ \ | | | | | | | | | | | | | | | 920faf5 share: remove hyphen in .desktop file (jpk68) ACKs: selsta
| * | share: remove hyphen in .desktop filejpk682026-06-301-1/+1
| | |
* | | Merge pull request #4615tobtoht2026-06-302-6/+8
|\ \ \ | | | | | | | | | | | | | | | | | | | | 0d37ac6 Fix "Quick Layouts recursive rearrange" spam on startup (plowsof) ACKs: plowsof
| * | | Fix "Quick Layouts recursive rearrange" spam on startupplowsof2026-06-252-6/+8
| | |/ | |/|
* | | Merge pull request #4614tobtoht2026-06-303-23/+5
|\ \ \ | | | | | | | | | | | | | | | | | | | | 5564db6 Dockerfiles: pin Qt to a commit hash (Thomas) ACKs: selsta
| * | | Dockerfiles: pin Qt to a commit hashThomas2026-06-233-23/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Qt was cloned with -b ${QT_VERSION} --depth 1 but, unlike every other dependency in these files, never reset to a commit, so a moved upstream tag would silently change the Qt source built into the release. Pin the qt5 superproject to its v5.15.19-lts-lgpl commit and let it resolve the submodules (git submodule update on linux/windows, init-repository on android), so only the qt5 hash is hardcoded. qt5 records the exact submodule commits, and the relative .gitmodules URLs keep the fetches on https. Follow-up to #4613.
* | | | Merge pull request #4620tobtoht2026-06-281-12/+12
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | f4bfb44 p2pool v4.17.1 (SChernykh) ACKs: selsta
| * | | | p2pool v4.17.1SChernykh2026-06-281-12/+12
|/ / / /
* | | | Merge pull request #4619tobtoht2026-06-263-6/+6
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | 2f61d86 docker: update libgpg-error and libgcrypt repo (selsta) ACKs: tobtoht
| * | | | docker: update libgpg-error and libgcrypt reposelsta2026-06-263-6/+6
|/ / / /
* | | | Merge pull request #4617tobtoht2026-06-253-0/+11
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | 123433d wizard: check wallet file directory is writeable (plowsof) ACKs: selsta
| * | | wizard: check wallet file directory is writeableplowsof2026-06-253-0/+11
|/ / /
* | | Merge pull request #4610tobtoht2026-06-224-5/+6
|\ \ \ | | | | | | | | | | | | | | | | | | | | 3d3a391 qml: escape untrusted text in remaining RichText views (Thomas) ACKs: selsta
| * | | qml: escape untrusted text in remaining RichText viewsThomas2026-06-184-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extends the escaping from commit 23ec5eb6 to the RichText sinks it did not cover: the transaction note in the tx details popup (History), the wallet name and account label in the send confirmation (TxConfirmationDialog), the address label on the merchant page (Merchant), and the wallet path on the info page (SettingsInfo). These were interpolated unescaped, so a value containing markup is rendered as rich text. The transaction note is the notable case: it can be set from a payment request's tx_description, so it is attacker influenced. Escape these fields with Utils.htmlEscape. Set the send confirmation From field to Text.RichText explicitly so the escaped entities decode in both of its branches; the single-account branch contains no tag and would otherwise render as plain text and show the raw entity.
* | | | Merge pull request #4613tobtoht2026-06-223-33/+33
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | 3c3f73c Dockerfiles: fetch dependencies over https instead of git:// / http:// (Thomas) ACKs: selsta
| * | | | Dockerfiles: fetch dependencies over https instead of git:// / http://Thomas2026-06-223-33/+33
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The release Dockerfiles cloned Qt (code.qt.io) and libgpg-error/libgcrypt (git.gnupg.org) over unauthenticated git://, and fetched libiconv (ftp.gnu.org) over http://. Qt is tag-pinned only, so a MITM on its clone could substitute source into the build. Switch them all to https, like every other dependency in these files. The gnupg commit pins and the libiconv sha256sum are unchanged.
* | | | Merge pull request #4611tobtoht2026-06-221-12/+12
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | b3e9423 p2pool v4.17 (SChernykh) ACKs: selsta
| * | | p2pool v4.17SChernykh2026-06-211-12/+12
|/ / /
* | | Merge pull request #4609tobtoht2026-06-201-4/+27
|\ \ \ | |/ / |/| | | | | | | | | | | 0fbb171 TransactionHistory: prevent CSV formula injection in writeCSV (Thomas) ACKs: selsta
| * | TransactionHistory: prevent CSV formula injection in writeCSVThomas2026-06-181-4/+27
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | writeCSV wrote the transaction note and subaddress label into the CSV stripping only the quote character. A cell beginning with =, +, - or @ can be interpreted as a formula by spreadsheet software on open, which CSV quoting does not prevent. The transaction note can be attacker-controlled: a payment request's tx_description is stored as the note when the payment is sent, so a crafted note can run a spreadsheet formula when the user later exports and opens their history, potentially enabling data exfiltration or command execution. Prefix affected fields with a single quote so they are treated as text; fields beginning with whitespace or a control character are prefixed too. Co-authored-by: selsta <selsta@sent.at>
* | Merge pull request #4602tobtoht2026-06-171-1/+1
|\ \ | | | | | | | | | | | | | | | 1627661 libwalletqt: capture background sync password by value (selsta) ACKs: plowsof
| * | libwalletqt: capture background sync password by valueselsta2026-06-031-1/+1
| | |
* | | Merge pull request #4603tobtoht2026-06-172-1/+15
|\ \ \ | | | | | | | | | | | | | | | | | | | | bfce02b libwalletqt: start wallet refresh worker lazily (selsta) ACKs: plowsof
| * | | libwalletqt: start wallet refresh worker lazilyselsta2026-06-052-1/+15
| |/ /
* | | Merge pull request #4596tobtoht2026-06-151-1/+11
|\ \ \ | | | | | | | | | | | | | | | | | | | | 082cf9a network: require SSL for HTTPS requests (selsta) ACKs: plowsof
| * | | network: require SSL for HTTPS requestsselsta2026-05-221-1/+11
| | |/ | |/|
* | | Merge pull request #4597tobtoht2026-06-152-5/+9
|\ \ \ | | | | | | | | | | | | | | | | | | | | be9eade QR: skip QImage padding when filling quirc buffer (selsta) ACKs: plowsof
| * | | QR: skip QImage padding when filling quirc bufferselsta2026-05-262-5/+9
| |/ / | | | | | | | | | also update quirc submodule
* | | Merge pull request #4605tobtoht2026-06-141-12/+12
|\ \ \ | |_|/ |/| | | | | | | | | | | 1c49150 P2Pool v4.16 (SChernykh) ACKs: nahuhh, selsta
| * | P2Pool v4.16SChernykh2026-06-131-12/+12
|/ /
* | Merge pull request #4600tobtoht2026-06-024-103/+5
|\ \ | | | | | | | | | 2d943ac workflows: switch to ucrt runtime for msys2 (selsta)
| * | workflows: switch to ucrt runtime for msys2selsta2026-06-024-103/+5
|/ /
* | Merge pull request #4599tobtoht2026-06-011-2/+2
|\ \ | | | | | | | | | 3e7e08a workflows: install unbound on macOS (selsta)
| * | workflows: install unbound on macOSselsta2026-06-011-2/+2
| |/
* | Merge pull request #4595tobtoht2026-05-223-3/+3
|\ \ | | | | | | | | | b9cee99 docker: update Qt to 5.15.19 (selsta)
| * | docker: update Qt to 5.15.19selsta2026-05-193-3/+3
| |/
* | Merge pull request #4593tobtoht2026-05-131-12/+12
|\ \ | | | | | | | | | 58f2015 P2Pool v4.15.1 (SChernykh)
| * | P2Pool v4.15.1SChernykh2026-05-111-12/+12
| |/
* | Merge pull request #4589tobtoht2026-05-131-3/+3
|\ \ | |/ |/| | | d5369f7 README: Qt 5.12 minimum (selsta)
| * README: Qt 5.12 minimumselsta2026-05-071-3/+3
|/
generated by cgit v1.2.3 (git 2.51.0) at 2026-08-15 22:32:23 +0000