nvda
d5510dcd - Merge pull request from GHSA-grvr-j2h8-3qm4

Commit
3 years ago
Merge pull request from GHSA-grvr-j2h8-3qm4 https://github.com/nvaccess/nvda/security/advisories/GHSA-grvr-j2h8-3qm4 Speech viewer remains open when Windows is locked. Speech viewer may contain a cache of secure information from the previous user session. That cache remains accessible when Windows is locked. This may lead to the exposure of private information. An unauthenticated user on the lock screen is able to update the Braille and Speech Viewer allow an authenticated users settings from the lock screen. These settings do not have security implications, however they should not be able to be updated by unauthenticated users. Speech Viewer is cleared when locking Windows. The Braille and Speech Viewer settings for "opening the viewer on start up" are disabled when Windows is locked. The Braille Viewer setting "hover for cell routing" does not change the user's configuration when Windows is locked. Created an `extensionPoint` for Windows session state changes. Added hook to clear speech viewer when Windows is locked. Added hooks and checks to disable/enable relevant settings when Windows is locked/unlocked.
Author
Parents
Loading