I love @kdecommunity and all, but this is quite the SNAFU. Oops. https://www.kde.org/info/security/advisory-20180208-2.txt …
Show this thread
-
Actually I think the advisory is wrong. As far as I can tell this has nothing to do with *mounting* devices. It's about the actions you get ("download photos with DigiKam" etc) - those basically run "/usr/bin/app <mountpoint>" and *that* is where they forgot to escape.
Show this thread
This makes more sense because mounting should be handled via DBus/UDisks and there's no reason for the shell to get involved.
