GNOME Bugzilla – Bug 685142
Calendar popup allows launching Control Center, Evolution
Last modified: 2012-10-08 17:49:56 UTC
In gnome-shell 3.5.92 and 3.6.0: Opening the calendar popup while in the login screen still displays the "Open Calendar" and "Date and Time Settings" menu items, which still launch the associated programs (gnome-control-center and evolution). They remain invisible since the login screen covers all other windows, but Evolution becomes visible (and can be interacted with) after logging in (although gdm seems to kill gnome-control-center). In other words, the user can run Evolution under gdm's account, and can use it to execute arbitrary other processes under that account (using Evolution's connection tunnel feature).
Created attachment 225550 [details] [review] patch
Review of attachment 225550 [details] [review]: While I see that indeed it doesn't work, there is code to handle hiding the "Date and Time Settings" item as a general settings action in PopupMenu. After some debugging, I found the problem to be the broken show-on-set-parent property in Clutter, and the fact that the menu item is reparented. The right fix is therefore to set show_on_set_parent to false before reparenting. I expected that to fix the separator too, but apparently it needs some hand holding as it is inside a vbox rather than a PopupMenuBase.
do you have a more proper patch ?
Created attachment 225615 [details] [review] Calendar: hide all actions when on the login screen No events on the login screen, and no opening calendars or settings either.
Why should show-on-set-parent matter?
Because the item is reparented, so if show-on-set-parent is true, the actor becomes visible, regardless of previous visibility. You can consider it a bug in clutter, if you want. To me, it's just a horrible but consistent API.
can we get this reviewed and landed ?
Review of attachment 225615 [details] [review]: Looks fine.
Attachment 225615 [details] pushed as 0f6effa - Calendar: hide all actions when on the login screen