450331 2022-02-15 18:58:18 +0000 when overview is mapped a modifier only shortcut, it works even at lock screen, thus the user's current windows and their contents are exposed. 2022-02-17 15:01:35 +0000 1 1 4 Plasma kwin effects-overview unspecified Other Linux RESOLVED FIXED VHI critical --- 1 partialtemplate kwin-bugs-null kde nate https://invent.kde.org/plasma/kwin/commit/39153cf77aac120476402b21c9fdd357ec1d40ce 5.24.2 0 oldest_to_newest 2105013 0 partialtemplate 2022-02-15 18:58:18 +0000 SUMMARY when overview is mapped a modifier only shortcut, it works even at the lock screen, thus the user's current windows and their contents are exposed. STEPS TO REPRODUCE 1. enable the overview effect 2. lock the screen(default : Meta+L) 3. activate overview effect via a modifier-only-shortcut OBSERVED RESULT overview effect activates, the contents of all windows in the current desktop session are shown. overview itself is unresponsive to user input. In addition, the CPU seems to overheat. EXPECTED RESULT overview effect should not activate when the user is unauthenticated. SOFTWARE/OS VERSIONS Windows: macOS: Linux/KDE Plasma: (available in About System) KDE Plasma Version: 5.24.1 KDE Frameworks Version: 5.91.0 Qt Version: 5.15.2 ADDITIONAL INFORMATION in kwinrc: [ModifierOnlyShortcuts] Alt= Control= Meta=org.kde.kglobalaccel,/component/kwin,,invokeShortcut,Overview Shift= 2105565 1 nate 2022-02-16 22:57:49 +0000 Cannot reproduce on Wayland, trying on X11... 2105569 2 nate 2022-02-16 23:15:22 +0000 Can reproduce on X11. Raising priority and severity due to the security implications. 2105574 3 kde 2022-02-16 23:44:22 +0000 We don't expose that in a GUI option anywhere. Still worth fixing, but not worth being too worried about it. 2105576 4 bug-janitor 2022-02-16 23:56:25 +0000 A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwin/-/merge_requests/2034 2105738 5 vlad.zahorodnii 2022-02-17 13:42:45 +0000 Git commit aab395f07bcfeca487b7736ddc10902d8510768c by Vlad Zahorodnii, on behalf of David Edmundson. Committed on 17/02/2022 at 13:01. Pushed by vladz into branch 'master'. Check lockscreen status for fullscreen effects Whilst global shortcuts are blocked by grabbing the keyboard, user set up manual scripts can still invoke a global action. Given we already have code to deactivate when locking it makes sense to also prevent activation. M +3 -0 src/effects/desktopgrid/desktopgrid.cpp M +3 -0 src/effects/overview/overvieweffect.cpp M +3 -0 src/effects/presentwindows/presentwindows.cpp https://invent.kde.org/plasma/kwin/commit/aab395f07bcfeca487b7736ddc10902d8510768c 2105743 6 vlad.zahorodnii 2022-02-17 13:51:36 +0000 Git commit 39153cf77aac120476402b21c9fdd357ec1d40ce by Vlad Zahorodnii, on behalf of David Edmundson. Committed on 17/02/2022 at 13:51. Pushed by vladz into branch 'Plasma/5.24'. Check lockscreen status for fullscreen effects Whilst global shortcuts are blocked by grabbing the keyboard, user set up manual scripts can still invoke a global action. Given we already have code to deactivate when locking it makes sense to also prevent activation. (cherry picked from commit aab395f07bcfeca487b7736ddc10902d8510768c) M +3 -0 src/effects/desktopgrid/desktopgrid.cpp M +3 -0 src/effects/overview/overvieweffect.cpp M +3 -0 src/effects/presentwindows/presentwindows.cpp https://invent.kde.org/plasma/kwin/commit/39153cf77aac120476402b21c9fdd357ec1d40ce