Bug 329375

Summary:	kscreenlock_greet insecure with multiple X screens
Product:	[Unmaintained] kscreensaver	Reporter:	TJ <kde>
Component:	locker-qml	Assignee:	Plasma Bugs List <plasma-bugs>
Status:	RESOLVED DUPLICATE
Severity:	major	CC:	mgraesslin, trebor_x
Priority:	NOR
Version:	4.11.4
Target Milestone:	---
Platform:	Ubuntu
OS:	Linux
URL:	https://bugs.launchpad.net/ubuntu/+source/kde-workspace/+bug/1264821
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Render background and greeter on correct X screen

Description TJ 2013-12-29 17:30:58 UTC

When using multiple X screens (3 in this case), kscreenlocker-greet behaves very badly and insecurely.

It appears to be drawing the desktop background image/screensaver images for all three X screens to the primary screen (0) and doesn't blank/screensave the monitors belonging to screens 1 and 2 (which leaves their contents in view), and it displays 2, maybe 3 greeter dialogs (1 may be hidden) on the primary X screen, but only accepts typed password input in 1 of them (the primary X screen's dialog).

Reading the source-code at

 ksmserver/screenlocker/greeter/greeterapp.cpp::UnlockApp::desktopResized()

it appears to iterate the screens via desktop()->screenCount() but assumes there is only one X display when showing the ScreenSaverWindow.



Reproducible: Always

Steps to Reproduce:
1. Configure multiple X screens
2. Lock
Actual Results:  
All background images and screensavers are drawn to X screen 0

Expected Results:  
Each  background image and screensaver should be rendered on the correct X screen

I'm testing a possible fix which passes display()->screen(i) to the QDeclarativeView constructor.

Photographs of the screens are attached to the referenced Ubuntu bug report #1264821.

Comment 1 TJ 2013-12-31 18:12:34 UTC

Created attachment 84383 [details]
Render background and greeter on correct X screen

This patch is for version up to 4.11.4.

The re-factoring for Plasma 2 needs a little more research since it replaces QDeclarativeView with a QQuickView, but the same solution (passing  QApplication->display()->screen(i)v) looks to be doable if the QWidget is exchangeable for the QWindow in the QQuickView constructor.

Comment 2 Martin Flöser 2014-01-03 10:10:18 UTC

are you really using multiple X screens like :0.0 and :0.1?

Comment 3 TJ 2014-01-03 17:33:40 UTC

Don't forget :0.2!

Comment 4 Martin Flöser 2014-01-03 17:49:16 UTC

ok, so it is multi-head.

This is a very uncommon setup and I doubt any developer is able to test and verify the patch.  From a quick look at the patch looks wrong to me, because you use "i" as an index in QDesktopWindow::screen(). This looks crashy to me and potentially wrong. In fact in your case I expect that it's always just 0. There should be three processes with one screen each. While on a more regular setup there is just one process with three screens attached.

Comment 5 Martin Flöser 2015-01-23 11:51:41 UTC


*** This bug has been marked as a duplicate of bug 314073 ***