Bug 429423 - New % placeholder representing full SMB path including password
Summary: New % placeholder representing full SMB path including password
Status: RESOLVED INTENTIONAL
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_filetypes (show other bugs)
Version: 5.20.2
Platform: Manjaro Linux
: NOR wishlist
Target Milestone: ---
Assignee: David Faure
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-21 00:52 UTC by lorenzo
Modified: 2020-11-25 15:28 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description lorenzo 2020-11-21 00:52:33 UTC
SUMMARY
A new % placeholder to represent the full SMB path smb://user:password@host/path/file including the password would make it possible to play videos through password-protected SMB e.g. with mplayer.

STEPS TO REPRODUCE
1. Choose a file type
2. Go to Application preference order
3. Choose an application and modify
4. Application Type → Command
5. There you have can enter %u, %f and so on



EXPECTED RESULT
Being able to execute commands like smplayer smb://user:password@host/path/file with a single click in Dolphin
Comment 1 Nate Graham 2020-11-23 18:33:33 UTC
This would have to be proposed at the FreeDesktop level as there is a spec governing such things: https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html

Regarding the particular issue you're trying to resolve, installing kio-fuse should do it. :)
Comment 2 lorenzo 2020-11-23 19:53:11 UTC
Proposed here:
https://gitlab.freedesktop.org/xdg/xdg-specs/-/issues/69
Comment 3 lorenzo 2020-11-25 14:30:13 UTC
David Faure, from the Desktop Entry Specification team, answered:

«This is very unsecure, all other users on the system can use ps to see the password.

That's the reason why it's not done this way.

Also, the Desktop Entry Specification (https://specifications.freedesktop.org/desktop-entry-spec/desktop-entry-spec-latest.html) doesn't say that the password should be removed so this is more of a KDE question than a freedesktop spec topic IMHO.»


So maybe the best solution on the KDE side would be to provide an «Add share password to the URL» checkbox, maybe with a warning about the security issue, to let the user choose?
Comment 4 Nate Graham 2020-11-25 15:28:41 UTC
The KDE solution is to use kio-fuse which transparently handles this exact use case without the need to expose any passwords in plaintext. So there's no reason to implement the proposal as it is redundant with an existing approach that solves the problem, just in a different way. :)