Index: head/devel/kf5-kauth/Makefile
===================================================================
--- head/devel/kf5-kauth/Makefile	(revision 492622)
+++ head/devel/kf5-kauth/Makefile	(revision 492623)
@@ -1,18 +1,18 @@
 # $FreeBSD$
 
 PORTNAME=	kauth
 DISTVERSION=	${KDE_FRAMEWORKS_VERSION}
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	devel kde kde-frameworks
 
 MAINTAINER=	kde@FreeBSD.org
 COMMENT=	KF5 abstraction to system policy and authentication features
 
 LIB_DEPENDS=	libpolkit-qt5-core-1.so:sysutils/polkit-qt@qt5
 
 USES=		cmake compiler:c++11-lib kde:5 qt:5 tar:xz
 USE_KDE=	coreaddons ecm
 USE_QT=		buildtools_build core dbus gui linguisttools qmake_build \
 		widgets
 
 .include <bsd.port.mk>
Index: head/devel/kf5-kauth/files/patch-git_fc70fb0
===================================================================
--- head/devel/kf5-kauth/files/patch-git_fc70fb0	(nonexistent)
+++ head/devel/kf5-kauth/files/patch-git_fc70fb0	(revision 492623)
@@ -0,0 +1,68 @@
+From fc70fb0161c1b9144d26389434d34dd135cd3f4a Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 2 Feb 2019 14:35:25 +0100
+Subject: Remove support for passing gui QVariants to KAuth helpers
+
+Supporting gui variants is very dangerous since they can end up triggering
+image loading plugins which are one of the biggest vectors for crashes, which
+for very smart people mean possible code execution, which is very dangerous
+in code that is executed as root.
+
+We've checked all the KAuth helpers inside KDE git and none seems to be using
+gui variants, so we're not actually limiting anything that people wanted to do.
+
+Reviewed by security@kde.org and Aleix Pol
+
+Issue reported by Fabian Vogt
+---
+ src/backends/dbus/DBusHelperProxy.cpp | 9 +++++++++
+ src/kauthaction.h                     | 2 ++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/src/backends/dbus/DBusHelperProxy.cpp b/src/backends/dbus/DBusHelperProxy.cpp
+index 10c14c6..8f0d336 100644
+--- src/backends/dbus/DBusHelperProxy.cpp
++++ src/backends/dbus/DBusHelperProxy.cpp
+@@ -31,6 +31,8 @@
+ #include "kf5authadaptor.h"
+ #include "kauthdebug.h"
+ 
++extern Q_CORE_EXPORT const QMetaTypeInterface *qMetaTypeGuiHelper;
++
+ namespace KAuth
+ {
+ 
+@@ -229,10 +231,17 @@ QByteArray DBusHelperProxy::performAction(const QString &action, const QByteArra
+         return ActionReply::HelperBusyReply().serialized();
+     }
+ 
++    // Make sure we don't try restoring gui variants, in particular QImage/QPixmap/QIcon are super dangerous
++    // since they end up calling the image loaders and thus are a vector for crashing → executing code
++    auto origMetaTypeGuiHelper = qMetaTypeGuiHelper;
++    qMetaTypeGuiHelper = nullptr;
++
+     QVariantMap args;
+     QDataStream s(&arguments, QIODevice::ReadOnly);
+     s >> args;
+ 
++    qMetaTypeGuiHelper = origMetaTypeGuiHelper;
++
+     m_currentAction = action;
+     emit remoteSignal(ActionStarted, action, QByteArray());
+     QEventLoop e;
+diff --git a/src/kauthaction.h b/src/kauthaction.h
+index c67a70a..01f3ba1 100644
+--- src/kauthaction.h
++++ src/kauthaction.h
+@@ -298,6 +298,8 @@ public:
+      * This method sets the variant map that the application
+      * can use to pass arbitrary data to the helper when executing the action.
+      *
++     * Only non-gui variants are supported.
++     *
+      * @param arguments The new arguments map
+      */
+     void setArguments(const QVariantMap &arguments);
+-- 
+cgit v1.1
+

Property changes on: head/devel/kf5-kauth/files/patch-git_fc70fb0
___________________________________________________________________
Added: fbsd:nokeywords
## -0,0 +1 ##
+yes
\ No newline at end of property
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property
Added: svn:mime-type
## -0,0 +1 ##
+text/plain
\ No newline at end of property