Dragging files to KDesktop

[Ingo Klöcker]

On Saturday 07 February 2004 12:41, Tobias Koenig wrote:
> Hi,
>
> I want to add the functionality to KAddressBook to export a vCard by
> simply dragging a contact out of the program and drop it on the
> desktop or in a konqueror window.
> But what's the best way to do it?
> QStoredDrag doesn't work because KDesktop doesn't try to decode it,
> it just looks for QImageDrag, QColorDrag and KURLDrag.
>
> But using KURLDrag + KTempFile to export the data causes two other
> problems:
>   - you can't remove the temporary file
>   - the file name is something like kaddressbookXTRDR5464F... not
> very user friendly
>
> The second issue could be solved by creating a file with the name of
> the contact under /tmp/ and pass this URL to the KURLDrag, but that
> would allow symlinks attacks again :(

FWIW, KMail saves attachments with their actual file names in safe 
temporary folders. But is a symlink attack actually an issue? Doesn't 
this attack only apply in case the temporay files are created in a 
world writable directory like /tmp?

Regards,
Ingo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: signature
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20040207/9f102084/attachment.sig>