<feed xmlns='http://www.w3.org/2005/Atom'>
<title>engrampa/src, branch master</title>
<subtitle>Engrampa archive manager for MATE</subtitle>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/'/>
<entry>
<title>ui: make update dialog smaller</title>
<updated>2026-08-31T04:02:11+00:00</updated>
<author>
<name>Victor Kareh</name>
<email>vkareh@redhat.com</email>
</author>
<published>2026-08-17T20:40:03+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=6975249401585f347faf4983e98cfef0516a4137'/>
<id>6975249401585f347faf4983e98cfef0516a4137</id>
<content type='text'>
The update confirmation dialog opened too big. This limits the labels to
60 characters and give the text column a minimum width so the dialog
stays reasonably small.

Fixes #555
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The update confirmation dialog opened too big. This limits the labels to
60 characters and give the text column a minimum width so the dialog
stays reasonably small.

Fixes #555
</pre>
</div>
</content>
</entry>
<entry>
<title>7z, tar: Remove p7zip -l switch</title>
<updated>2026-08-11T18:01:08+00:00</updated>
<author>
<name>2387skju</name>
<email>2387skju@users.noreply.github.com</email>
</author>
<published>2026-08-02T09:30:12+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=426e765c0fd9e83a53e9cbbe4e7a3f5040af61f9'/>
<id>426e765c0fd9e83a53e9cbbe4e7a3f5040af61f9</id>
<content type='text'>
The -l switch doesn’t exist anymore.

command-7z:
 This old code was never called: Variable recursive is everytime FALSE in engrampa.

command-tar:
 This will fix this bug: Non working .tar.7z:
   Affected distributions: Debian, Ubuntu, Arch Linux ?, Fedora.
   These distributions do not have the original commands 7zz 7zzs installed anymore (or not at default).
   Therefore the legacy p7zip will be false detected.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The -l switch doesn’t exist anymore.

command-7z:
 This old code was never called: Variable recursive is everytime FALSE in engrampa.

command-tar:
 This will fix this bug: Non working .tar.7z:
   Affected distributions: Debian, Ubuntu, Arch Linux ?, Fedora.
   These distributions do not have the original commands 7zz 7zzs installed anymore (or not at default).
   Therefore the legacy p7zip will be false detected.
</pre>
</div>
</content>
</entry>
<entry>
<title>fr-command-rpm: prevent path traversal when extracting RPM archives</title>
<updated>2026-08-08T11:56:43+00:00</updated>
<author>
<name>gaoyukun</name>
<email>gaoyukun@kylinos.cn</email>
</author>
<published>2026-08-06T02:58:47+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=c4b90ec015b82e2b85d9e5f5d2ea3486a7936c8b'/>
<id>c4b90ec015b82e2b85d9e5f5d2ea3486a7936c8b</id>
<content type='text'>
CVE-2023-52138 fixes path traversal via crafted cpio archives by
adding --no-absolute-filenames to the cpio extraction command in
fr-command-cpio.c (commit 63d5dfa).  However the same vulnerability
still exists in the RPM extraction path, which pipes rpm2cpio output
into 'cpio -idu' without that flag.  A crafted RPM whose cpio payload
contains absolute paths can therefore write files outside the
extraction directory (e.g. ~/.ssh, ~/.bashrc).

Add the same --no-absolute-filenames flag to the rpm2cpio | cpio
pipeline to close the gap.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
CVE-2023-52138 fixes path traversal via crafted cpio archives by
adding --no-absolute-filenames to the cpio extraction command in
fr-command-cpio.c (commit 63d5dfa).  However the same vulnerability
still exists in the RPM extraction path, which pipes rpm2cpio output
into 'cpio -idu' without that flag.  A crafted RPM whose cpio payload
contains absolute paths can therefore write files outside the
extraction directory (e.g. ~/.ssh, ~/.bashrc).

Add the same --no-absolute-filenames flag to the rpm2cpio | cpio
pipeline to close the gap.
</pre>
</div>
</content>
</entry>
<entry>
<title>fixed wrong drag&amp;drop activation when in single click mode</title>
<updated>2026-05-04T13:44:19+00:00</updated>
<author>
<name>Victor Kareh</name>
<email>vkareh@redhat.com</email>
</author>
<published>2026-04-02T17:38:49+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=4d63a91c0ad9da7bc851df1bd8700737de2ec17f'/>
<id>4d63a91c0ad9da7bc851df1bd8700737de2ec17f</id>
<content type='text'>
when calling the parent button_press_event function a
button released event could be emitted, in that case
stop the drag&amp;drop action.

Backported from https://gitlab.gnome.org/GNOME/file-roller/-/commit/279b76d6

Fixes #547
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
when calling the parent button_press_event function a
button released event could be emitted, in that case
stop the drag&amp;drop action.

Backported from https://gitlab.gnome.org/GNOME/file-roller/-/commit/279b76d6

Fixes #547
</pre>
</div>
</content>
</entry>
<entry>
<title>lha: Fix support for file names with spaces</title>
<updated>2026-03-13T23:01:59+00:00</updated>
<author>
<name>Colomban Wendling</name>
<email>cwendling@hypra.fr</email>
</author>
<published>2025-06-25T08:58:19+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=94f991e4dbca9c9224740170180170cbe652f3f9'/>
<id>94f991e4dbca9c9224740170180170cbe652f3f9</id>
<content type='text'>
See e.g. lha_os2_208/lfn.lzh or lha_os2_208/h3_lfn.lzh from
https://github.com/fragglet/lhasa/tree/master/test/archives.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
See e.g. lha_os2_208/lfn.lzh or lha_os2_208/h3_lfn.lzh from
https://github.com/fragglet/lhasa/tree/master/test/archives.
</pre>
</div>
</content>
</entry>
<entry>
<title>lha: Use named fields instead of magic numbers</title>
<updated>2026-03-13T23:01:59+00:00</updated>
<author>
<name>Colomban Wendling</name>
<email>cwendling@hypra.fr</email>
</author>
<published>2025-06-25T08:57:44+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=daa4866d7e8a5efbc2e69f3ba514893d354bed60'/>
<id>daa4866d7e8a5efbc2e69f3ba514893d354bed60</id>
<content type='text'>
This makes the code a tad clearer.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This makes the code a tad clearer.
</pre>
</div>
</content>
</entry>
<entry>
<title>lha: Fix crash, parse lha list output correctly</title>
<updated>2026-03-13T23:01:59+00:00</updated>
<author>
<name>Simon Howard</name>
<email>fraggle@soulsphere.org</email>
</author>
<published>2025-06-18T18:50:28+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=3e29eee56d617e040d8ddf619d565689cae62b05'/>
<id>3e29eee56d617e040d8ddf619d565689cae62b05</id>
<content type='text'>
The output from the `lha` list archive command is eclectic and
inconsistent, and engrampa was actually crashing when opening certain
archives (eg. lha_os2_208/h3_subdir.lzh in the Lhasa test suite). But this
also fixes the list parsing more generally. With this change, engrampa
now appears to successfully open all of the .lzh files in the Lhasa test
suite correctly without crashing.

The first field in lha's list output either contains Unix permissions or
an OS name in [brackets]. There was already hard-coded support for
[MS-DOS], [generic], [unknown] and [Amiga], but other OS names were not
handled properly. This is now fixed, with an approach that is mindful of
the fact that the OS name can contain spaces.

Empty value (whitespace) in the UID/GID column is also handled
correctly.  This was partially working because of the aforementioned
special-casing, but now is fixed more generally.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The output from the `lha` list archive command is eclectic and
inconsistent, and engrampa was actually crashing when opening certain
archives (eg. lha_os2_208/h3_subdir.lzh in the Lhasa test suite). But this
also fixes the list parsing more generally. With this change, engrampa
now appears to successfully open all of the .lzh files in the Lhasa test
suite correctly without crashing.

The first field in lha's list output either contains Unix permissions or
an OS name in [brackets]. There was already hard-coded support for
[MS-DOS], [generic], [unknown] and [Amiga], but other OS names were not
handled properly. This is now fixed, with an approach that is mindful of
the fact that the OS name can contain spaces.

Empty value (whitespace) in the UID/GID column is also handled
correctly.  This was partially working because of the aforementioned
special-casing, but now is fixed more generally.
</pre>
</div>
</content>
</entry>
<entry>
<title>fix memleaks</title>
<updated>2026-03-12T16:25:03+00:00</updated>
<author>
<name>mbkma</name>
<email>johannes.unruh@fau.de</email>
</author>
<published>2026-03-11T23:02:13+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=0f6bc869de89a3115628d7895965bf712a2055f3'/>
<id>0f6bc869de89a3115628d7895965bf712a2055f3</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Avoid critical errors with invalid dates</title>
<updated>2025-07-02T20:12:54+00:00</updated>
<author>
<name>Colomban Wendling</name>
<email>cwendling@hypra.fr</email>
</author>
<published>2025-06-25T09:29:04+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=ab1324372b8d9ba7f11a7b5f5d35da7e3f4c3924'/>
<id>ab1324372b8d9ba7f11a7b5f5d35da7e3f4c3924</id>
<content type='text'>
This likely should not happen with valid dates, but can if a archiver
reports invalid ones for whatever reason (legitimate weird dates, or
parser failures for example).
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This likely should not happen with valid dates, but can if a archiver
reports invalid ones for whatever reason (legitimate weird dates, or
parser failures for example).
</pre>
</div>
</content>
</entry>
<entry>
<title>rar: Fix asking password for encrypted archives with RAR7</title>
<updated>2025-06-25T08:12:38+00:00</updated>
<author>
<name>Colomban Wendling</name>
<email>cwendling@hypra.fr</email>
</author>
<published>2025-03-17T22:21:52+00:00</published>
<link rel='alternate' type='text/html' href='http://git.mate-desktop.org/engrampa/commit/?id=bfad4da5b243c6353b21e499813c0a80790d3f98'/>
<id>bfad4da5b243c6353b21e499813c0a80790d3f98</id>
<content type='text'>
RAR 7.0 outputs a different error when password is missing:

&gt;
&gt; Incorrect password for foo.rar
&gt; Incorrect password for foo.rar
&gt; Cannot find volume foo.r00

Whereas RAR 6.21 doesn't output the last 2 lines.

The error about volumes confuses the parser thinking there's a volume
issue, which hides the incorrect password one.

Note that RAR 7.0 outputs this *most of the time*, but once in a while
it'll also skip the last 2 lines.  Whether it is a race condition or
not, it at least happens often enough with RAR 7.0 to consider this its
normal behavior and handle it.

Fixes #526.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
RAR 7.0 outputs a different error when password is missing:

&gt;
&gt; Incorrect password for foo.rar
&gt; Incorrect password for foo.rar
&gt; Cannot find volume foo.r00

Whereas RAR 6.21 doesn't output the last 2 lines.

The error about volumes confuses the parser thinking there's a volume
issue, which hides the incorrect password one.

Note that RAR 7.0 outputs this *most of the time*, but once in a while
it'll also skip the last 2 lines.  Whether it is a race condition or
not, it at least happens often enough with RAR 7.0 to consider this its
normal behavior and handle it.

Fixes #526.
</pre>
</div>
</content>
</entry>
</feed>
