Rebased ref, commits from common ancestor:
commit 5669f498e84622dd969bb7ee83583701087df82b
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Sun Feb 25 08:48:08 2024 +0600
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    Use SAL_WNODEPRECATED_DECLARATIONS_(PUSH|POP)
    
    Change-Id: I2810d22e8f5e1c81647b9e9b15519de65939630a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163895
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>

diff --git a/filter/source/xsltfilter/LibXSLTTransformer.cxx 
b/filter/source/xsltfilter/LibXSLTTransformer.cxx
index 2acc7dba07b5..14088a70ee2a 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.cxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.cxx
@@ -478,21 +478,9 @@ namespace XSLT
             params = args;
         }
 
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
-#if defined(_MSC_VER)
-#pragma warning(push)
-#pragma warning(disable:4996)
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
         xmlSubstituteEntitiesDefault(0);
-#if defined(_MSC_VER)
-#pragma warning(pop)
-#endif
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
 
         m_parameters.clear();
         for (int i = 0; i < params.getLength(); i++)
diff --git a/helpcompiler/source/HelpCompiler.cxx 
b/helpcompiler/source/HelpCompiler.cxx
index 98fd7f6eb55d..9cd0425c2e05 100644
--- a/helpcompiler/source/HelpCompiler.cxx
+++ b/helpcompiler/source/HelpCompiler.cxx
@@ -44,21 +44,9 @@ HelpCompiler::HelpCompiler(StreamTable &in_streamTable, 
const fs::path &in_input
     src(in_src), zipdir(in_zipdir), module(in_module), lang(in_lang), 
resCompactStylesheet(in_resCompactStylesheet),
     resEmbStylesheet(in_resEmbStylesheet), bExtensionMode( in_bExtensionMode )
 {
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
-#if defined(_MSC_VER)
-#pragma warning(push)
-#pragma warning(disable:4996)
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
     xmlKeepBlanksDefaultValue = 0;
-#if defined(_MSC_VER)
-#pragma warning(pop)
-#endif
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
     char* os = getenv("OS");
     if (os)
     {
diff --git a/vcl/unx/generic/printer/cupsmgr.cxx 
b/vcl/unx/generic/printer/cupsmgr.cxx
index 3c910f3b39df..6651f23bdf68 100644
--- a/vcl/unx/generic/printer/cupsmgr.cxx
+++ b/vcl/unx/generic/printer/cupsmgr.cxx
@@ -82,14 +82,9 @@ struct GetPPDAttribs
     {
         // This CUPS method is not at all thread-safe we need
         // to dup the pointer to a static buffer it returns ASAP
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
         OString aResult = cupsGetPPD(m_aParameter.getStr());
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
         MutexGuard aGuard( *m_pSyncMutex );
         m_aResult = aResult;
         m_aCondition.set();
@@ -222,10 +217,7 @@ void CUPSManager::runDests()
 
     // n#722902 - do a fast-failing check for cups working *at all* first
     http_t* p_http;
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
     if( (p_http=httpConnectEncrypt(
              cupsServer(),
              ippPort(),
@@ -242,9 +234,7 @@ void CUPSManager::runDests()
 
         httpClose(p_http);
     }
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
 }
 
 void CUPSManager::initialize()
@@ -454,14 +444,9 @@ const PPDParser* CUPSManager::createCUPSParser( const 
OUString& rPrinter )
                     rtl_TextEncoding aEncoding = osl_getThreadTextEncoding();
                     OUString aFileName( OStringToOUString( aPPDFile, aEncoding 
) );
                     // update the printer info with context information
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
                     ppd_file_t* pPPD = ppdOpenFile( aPPDFile.getStr() );
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
                     if( pPPD )
                     {
                         // create the new parser
@@ -469,14 +454,9 @@ const PPDParser* CUPSManager::createCUPSParser( const 
OUString& rPrinter )
                         pCUPSParser->m_aFile = rPrinter;
                         pNewParser = pCUPSParser;
 
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
                         /*int nConflicts =*/ cupsMarkOptions( pPPD, 
pDest->num_options, pDest->options );
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
                         SAL_INFO("vcl.unx.print", "processing the following 
options for printer " << pDest->name << " (instance " << (pDest->instance == 
nullptr ? "null" : pDest->instance) << "):");
                         for( int k = 0; k < pDest->num_options; k++ )
                             SAL_INFO("vcl.unx.print",
@@ -497,14 +477,9 @@ const PPDParser* CUPSManager::createCUPSParser( const 
OUString& rPrinter )
                         rInfo.m_aContext = rContext;
 
                         // clean up the mess
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
                         ppdClose( pPPD );
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
 
                     }
                     else
diff --git a/xmlsecurity/source/xmlsec/saxhelper.cxx 
b/xmlsecurity/source/xmlsec/saxhelper.cxx
index 8ae3622c24a4..4f50e4d5c665 100644
--- a/xmlsecurity/source/xmlsec/saxhelper.cxx
+++ b/xmlsecurity/source/xmlsec/saxhelper.cxx
@@ -118,24 +118,12 @@ SAXHelper::SAXHelper( )
      * compile error:
      * xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS ;
      */
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
-#if defined(_MSC_VER)
-#pragma warning(push)
-#pragma warning(disable:4996)
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_PUSH
     xmlSubstituteEntitiesDefault(0) ;
 #ifndef XMLSEC_NO_XSLT
     xmlIndentTreeOutput = 1 ;
 #endif /* XMLSEC_NO_XSLT */
-#if defined(_MSC_VER)
-#pragma warning(pop)
-#endif
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif
+SAL_WNODEPRECATED_DECLARATIONS_POP
 
     m_pParserCtxt = xmlNewParserCtxt() ;
 
commit 4e20d6ef813135e4cfe7f0cb47fc35cc7c2cdd58
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Tue Feb 27 11:01:29 2024 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    helpcompiler: suppress deprecation warning
    
    Commit 77cb90532d14d5035990d078977fce7b407c4fad removed these 2 lines
    but i don't want to check if the "I can find no difference in our output
    help dir with these removed" is true also in this older branch so
    suppress the warning instead.
    
    Change-Id: I35865e3accd018462ef4d65c8c11fb914f53ac38

diff --git a/helpcompiler/source/HelpCompiler.cxx 
b/helpcompiler/source/HelpCompiler.cxx
index 0436d9efb461..98fd7f6eb55d 100644
--- a/helpcompiler/source/HelpCompiler.cxx
+++ b/helpcompiler/source/HelpCompiler.cxx
@@ -149,9 +149,15 @@ xmlDocPtr HelpCompiler::getSourceDocument(const fs::path 
&filePath)
         if (!cur)
         {
             static std::string fsroot('\'' + src.toUTF8() + '\'');
-
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
             xmlSubstituteEntitiesDefault(1);
             xmlLoadExtDtdDefaultValue = 1;
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
             cur = xsltParseStylesheetFile(reinterpret_cast<const xmlChar 
*>(resEmbStylesheet.native_file_string().c_str()));
 
             int nbparams = 0;
commit 4305ea00750efa3dd84eaac9c8c5b4bd995b4d67
Author:     Tünde Tóth <tund...@gmail.com>
AuthorDate: Thu Aug 1 15:26:55 2019 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    tdf#125041 fix hyperlinks to IDN websites
    
    Revert "tdf#86087 Open relative links in Writer"
    
    This reverts commit 4b9e237850efe36f7e35d65e14d6953f1e1f3a45.
    
    The reverted commit caused a regression in the handling of
    internationalized domain names: these non-ASCII URLs were converted
    to file URIs.
    
    Change-Id: Ia481aa1199d20083b72f9f8571992e40b3fc2e77
    Reviewed-on: https://gerrit.libreoffice.org/76804
    Reviewed-by: László Németh <nem...@numbertext.org>
    Tested-by: László Németh <nem...@numbertext.org>

diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx 
b/sw/source/uibase/wrtsh/wrtsh2.cxx
index a3d27216e490..255f3f451e7c 100644
--- a/sw/source/uibase/wrtsh/wrtsh2.cxx
+++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
@@ -482,28 +482,11 @@ static void LoadURL(SwView& rView, const OUString& rURL, 
LoadUrlFlags nFilter,
     if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, 
pViewFrame->GetWindow().GetFrameWeld()))
         return;
 
-    OUString sFileURL = rURL;
-    INetURLObject aURL( sFileURL );
-    if( aURL.GetProtocol() == INetProtocol::NotValid && 
!sFileURL.startsWith("#") )
-    {
-        // May be the relative link -> try to convert to absolute path
-        OUString sParentPath =
-            
rVSh.GetDoc()->GetDocShell()->GetMedium()->GetURLObject().GetPath();
-
-        bool bCorrectURL = true;
-        aURL = INetURLObject();
-        bCorrectURL &= aURL.setFSysPath( sParentPath, FSysStyle::Detect );
-        bCorrectURL &= aURL.insertName( sFileURL );
-
-        if( bCorrectURL )
-            sFileURL = aURL.GetMainURL( 
INetURLObject::DecodeMechanism::Unambiguous );
-    }
-
     // We are doing tiledRendering, let the client handles the URL loading,
     // unless we are jumping to a TOC mark.
     if (comphelper::LibreOfficeKit::isActive() && !rURL.startsWith("#"))
     {
-        
rVSh.GetSfxViewShell()->libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED,
 sFileURL.toUtf8().getStr());
+        rView.libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, 
rURL.toUtf8().getStr());
         return;
     }
 
@@ -522,7 +505,7 @@ static void LoadURL(SwView& rView, const OUString& rURL, 
LoadUrlFlags nFilter,
     if( pDShell && pDShell->GetMedium() )
         sReferer = pDShell->GetMedium()->GetName();
     SfxFrameItem aView( SID_DOCFRAME, pViewFrame );
-    SfxStringItem aName( SID_FILE_NAME, sFileURL );
+    SfxStringItem aName( SID_FILE_NAME, rURL );
     SfxStringItem aTargetFrameName( SID_TARGETNAME, sTargetFrame );
     SfxStringItem aReferer( SID_REFERER, sReferer );
 
commit 753f628abbbba0296c383a3c92a25a20e18e28e9
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Feb 15 18:51:27 2024 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    tdf#159502 libxml2: apply Solaris ld patch only on Solaris
    
    Diverging from upstream by inventing a LIBXML2_GLOBAL_VARIABLES version
    should only be done if actually required.
    
    Change-Id: I1520ca5078dc24ffd83e927f9c857d625e71749b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163455
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit eebdda4e221327cae5a9177893394819ca510d5f)

diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 3970cd26fb76..4b9fc5530a55 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -14,7 +14,7 @@ $(eval $(call 
gb_UnpackedTarball_set_tarball,libxml2,$(LIBXML_TARBALL),,libxml2)
 $(eval $(call gb_UnpackedTarball_update_autoconf_configs,libxml2))
 
 $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
-       external/libxml2/libxml2-global-symbols.patch \
+       $(if $(filter 
SOLARIS,$(OS)),external/libxml2/libxml2-global-symbols.patch) \
        external/libxml2/libxml2-vc10.patch \
        external/libxml2/libxml2-XMLCALL-redefine.patch.0 \
        $(if $(filter ANDROID,$(OS)),external/libxml2/libxml2-android.patch) \
commit 3673db0d0b78889eb347730a3df1167b4c695a6d
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Mon Nov 27 08:02:59 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    tdf#158302 fix build against system-libxml-2.12
    
    Seen in a fedora:40 container, using --with-system-libcmis,
    --with-system-liblangtag and --with-system-xmlsec.
    
    Change-Id: I9d748d3dc0b70dbfdfcb6b99c9ce8440bda6f326
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159980
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit c8f7408db73d2f2ccacb25a2b4fef8dfebdfc6cb)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161661
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 764890a53cea2ccb6d2fb6d8c7edb5e1c91ecdc0)
    (cherry picked from commit 81cc1e539114cf826f82c3d3718fe0dfacf66a9a)

diff --git a/drawinglayer/source/tools/primitive2dxmldump.cxx 
b/drawinglayer/source/tools/primitive2dxmldump.cxx
index 65170ae096f2..4c12c32ae079 100644
--- a/drawinglayer/source/tools/primitive2dxmldump.cxx
+++ b/drawinglayer/source/tools/primitive2dxmldump.cxx
@@ -16,6 +16,8 @@
 #include <tools/XmlWriter.hxx>
 
 #include <memory>
+#include <libxml/parser.h>
+#include <sal/log.hxx>
 
 #include <drawinglayer/primitive2d/drawinglayer_primitivetypes2d.hxx>
 #include <drawinglayer/primitive2d/transformprimitive2d.hxx>
diff --git a/filter/source/xsltfilter/LibXSLTTransformer.cxx 
b/filter/source/xsltfilter/LibXSLTTransformer.cxx
index 6eae79675fd2..2acc7dba07b5 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.cxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.cxx
@@ -320,7 +320,7 @@ namespace XSLT
         }
         else
         {
-            xmlErrorPtr lastErr = xmlGetLastError();
+            const xmlError* lastErr = xmlGetLastError();
             OUString msg;
             if (lastErr)
                 msg = OStringToOUString(lastErr->message, 
RTL_TEXTENCODING_UTF8);
diff --git a/helpcompiler/source/HelpLinker.cxx 
b/helpcompiler/source/HelpLinker.cxx
index fc5894b080ad..7389b50c32b9 100644
--- a/helpcompiler/source/HelpLinker.cxx
+++ b/helpcompiler/source/HelpLinker.cxx
@@ -809,7 +809,11 @@ static const HelpProcessingException* 
GpXMLParsingException = nullptr;
 
 extern "C" {
 
+#if LIBXML_VERSION >= 21200
+static void StructuredXMLErrorFunction(SAL_UNUSED_PARAMETER void *, const 
xmlError* error)
+#else
 static void StructuredXMLErrorFunction(SAL_UNUSED_PARAMETER void *, 
xmlErrorPtr error)
+#endif
 {
     std::string aErrorMsg = error->message;
     std::string aXMLParsingFile;
diff --git a/include/xmloff/xmltoken.hxx b/include/xmloff/xmltoken.hxx
index 008004242742..edca38e50ac9 100644
--- a/include/xmloff/xmltoken.hxx
+++ b/include/xmloff/xmltoken.hxx
@@ -703,7 +703,7 @@ namespace xmloff { namespace token {
         XML_EMBEDDED_VISIBLE_AREA,
         XML_EMBOSSED,
         XML_EMISSIVE_COLOR,
-        XML_EMPTY,
+        XML_TOKEN_EMPTY,
         XML_EMPTY_LINE_REFRESH,
         XML_ENABLE_NUMBERING,
         XML_ENABLED,
diff --git a/sax/source/fastparser/fastparser.cxx 
b/sax/source/fastparser/fastparser.cxx
index e37d7c0968e1..6a48ad85a4e8 100644
--- a/sax/source/fastparser/fastparser.cxx
+++ b/sax/source/fastparser/fastparser.cxx
@@ -550,7 +550,7 @@ Event& Entity::getEvent( CallbackType aType )
 OUString lclGetErrorMessage( xmlParserCtxtPtr ctxt, const OUString& sSystemId, 
sal_Int32 nLine )
 {
     const sal_Char* pMessage;
-    xmlErrorPtr error = xmlCtxtGetLastError( ctxt );
+    const xmlError* error = xmlCtxtGetLastError( ctxt );
     if( error && error->message )
         pMessage = error->message;
     else
diff --git a/sc/source/core/tool/interpr7.cxx b/sc/source/core/tool/interpr7.cxx
index 7f573f6809a2..78e9528f2a66 100644
--- a/sc/source/core/tool/interpr7.cxx
+++ b/sc/source/core/tool/interpr7.cxx
@@ -34,6 +34,7 @@
 
 #include <cstring>
 #include <memory>
+#include <libxml/parser.h>
 
 using namespace com::sun::star;
 
diff --git a/sc/source/filter/xml/XMLExportDataPilot.cxx 
b/sc/source/filter/xml/XMLExportDataPilot.cxx
index 42cf6b501990..173a5c627a41 100644
--- a/sc/source/filter/xml/XMLExportDataPilot.cxx
+++ b/sc/source/filter/xml/XMLExportDataPilot.cxx
@@ -127,7 +127,7 @@ void ScXMLExportDataPilot::WriteDPCondition(const 
ScQueryEntry& aQueryEntry, boo
 
     if (aQueryEntry.IsQueryByEmpty())
     {
-        rExport.AddAttribute(XML_NAMESPACE_TABLE, XML_OPERATOR, 
GetXMLToken(XML_EMPTY));
+        rExport.AddAttribute(XML_NAMESPACE_TABLE, XML_OPERATOR, 
GetXMLToken(XML_TOKEN_EMPTY));
     }
     else if (aQueryEntry.IsQueryByNonEmpty())
     {
diff --git a/sc/source/filter/xml/XMLExportDatabaseRanges.cxx 
b/sc/source/filter/xml/XMLExportDatabaseRanges.cxx
index 5fc7ccb01585..7395a4e5290d 100644
--- a/sc/source/filter/xml/XMLExportDatabaseRanges.cxx
+++ b/sc/source/filter/xml/XMLExportDatabaseRanges.cxx
@@ -387,7 +387,7 @@ private:
             case SC_EQUAL:
             {
                 if (rEntry.IsQueryByEmpty())
-                    return GetXMLToken(XML_EMPTY);
+                    return GetXMLToken(XML_TOKEN_EMPTY);
                 else if (rEntry.IsQueryByNonEmpty())
                     return GetXMLToken(XML_NOEMPTY);
 
diff --git a/sc/source/filter/xml/xmlfilti.cxx 
b/sc/source/filter/xml/xmlfilti.cxx
index 47fea817123c..a84f12cdd47e 100644
--- a/sc/source/filter/xml/xmlfilti.cxx
+++ b/sc/source/filter/xml/xmlfilti.cxx
@@ -380,7 +380,7 @@ void ScXMLConditionContext::GetOperator(
         rEntry.eOp = SC_BOTPERC;
     else if (IsXMLToken(aOpStr, XML_BOTTOM_VALUES))
         rEntry.eOp = SC_BOTVAL;
-    else if (IsXMLToken(aOpStr, XML_EMPTY))
+    else if (IsXMLToken(aOpStr, XML_TOKEN_EMPTY))
         rEntry.SetQueryByEmpty();
     else if (aOpStr == ">")
         rEntry.eOp = SC_GREATER;
@@ -759,7 +759,7 @@ void SAL_CALL ScXMLDPConditionContext::endFastElement( 
sal_Int32 /*nElement*/ )
     else
         aFilterField.eConnect = SC_AND;
     pFilterContext->SetIsCaseSensitive(bIsCaseSensitive);
-    if (IsXMLToken(sOperator, XML_EMPTY))
+    if (IsXMLToken(sOperator, XML_TOKEN_EMPTY))
         aFilterField.SetQueryByEmpty();
     else if (IsXMLToken(sOperator, XML_NOEMPTY))
         aFilterField.SetQueryByNonEmpty();
diff --git a/unoxml/source/dom/attr.cxx b/unoxml/source/dom/attr.cxx
index 4ff411d3f62c..39889e114c99 100644
--- a/unoxml/source/dom/attr.cxx
+++ b/unoxml/source/dom/attr.cxx
@@ -22,6 +22,7 @@
 #include <string.h>
 
 #include <memory>
+#include <libxml/entities.h>
 
 #include <osl/diagnose.h>
 #include <sal/log.hxx>
diff --git a/unoxml/source/dom/document.cxx b/unoxml/source/dom/document.cxx
index 94dce24255ac..5cefa208abdc 100644
--- a/unoxml/source/dom/document.cxx
+++ b/unoxml/source/dom/document.cxx
@@ -41,6 +41,7 @@
 #include <eventdispatcher.hxx>
 
 #include <string.h>
+#include <libxml/xmlIO.h>
 
 #include <osl/diagnose.h>
 
diff --git a/unoxml/source/dom/documentbuilder.cxx 
b/unoxml/source/dom/documentbuilder.cxx
index bbb412a32df0..b8f4ce36a212 100644
--- a/unoxml/source/dom/documentbuilder.cxx
+++ b/unoxml/source/dom/documentbuilder.cxx
@@ -25,6 +25,7 @@
 
 #include <libxml/xmlerror.h>
 #include <libxml/tree.h>
+#include <libxml/parser.h>
 
 #include <memory>
 
diff --git a/unoxml/source/dom/entity.cxx b/unoxml/source/dom/entity.cxx
index 74b1faaf7e75..0b8c384ddcc1 100644
--- a/unoxml/source/dom/entity.cxx
+++ b/unoxml/source/dom/entity.cxx
@@ -22,6 +22,7 @@
 #include <osl/diagnose.h>
 
 #include <string.h>
+#include <libxml/entities.h>
 
 using namespace css::uno;
 using namespace css::xml::dom;
diff --git a/unoxml/source/xpath/xpathapi.cxx b/unoxml/source/xpath/xpathapi.cxx
index 415f565d3ae0..d62aa48a1082 100644
--- a/unoxml/source/xpath/xpathapi.cxx
+++ b/unoxml/source/xpath/xpathapi.cxx
@@ -26,6 +26,7 @@
 #include <libxml/xmlerror.h>
 #include <libxml/xpath.h>
 #include <libxml/xpathInternals.h>
+#include <libxml/xmlIO.h>
 
 #include <rtl/ustrbuf.hxx>
 #include <sal/log.hxx>
@@ -243,7 +244,7 @@ namespace XPath
         return selectSingleNode(contextNode, expr);
     }
 
-    static OUString make_error_message(xmlErrorPtr pError)
+    static OUString make_error_message(const xmlError* pError)
     {
         OUStringBuffer buf;
         if (pError) {
@@ -286,7 +287,11 @@ namespace XPath
             SAL_WARN("unoxml", "libxml2 error: " << str);
         }
 
+#if LIBXML_VERSION >= 21200
+        static void structured_error_func(void *, const xmlError* error)
+#else
         static void structured_error_func(void *, xmlErrorPtr error)
+#endif
         {
             SAL_WARN("unoxml", "libxml2 error: " << make_error_message(error));
         }
diff --git a/xmloff/source/core/xmltoken.cxx b/xmloff/source/core/xmltoken.cxx
index 5ca78919e3fb..5d941d76d781 100644
--- a/xmloff/source/core/xmltoken.cxx
+++ b/xmloff/source/core/xmltoken.cxx
@@ -704,7 +704,7 @@ namespace xmloff { namespace token {
         TOKEN( "embedded-visible-area",           XML_EMBEDDED_VISIBLE_AREA ),
         TOKEN( "embossed",                        XML_EMBOSSED ),
         TOKEN( "emissive-color",                  XML_EMISSIVE_COLOR ),
-        TOKEN( "empty",                           XML_EMPTY ),
+        TOKEN( "empty",                           XML_TOKEN_EMPTY ),
         TOKEN( "empty-line-refresh",              XML_EMPTY_LINE_REFRESH ),
         TOKEN( "enable-numbering",                XML_ENABLE_NUMBERING ),
         TOKEN( "enabled",                         XML_ENABLED ),
diff --git a/xmloff/source/draw/sdpropls.cxx b/xmloff/source/draw/sdpropls.cxx
index 3848ef8f68e7..1f440090510f 100644
--- a/xmloff/source/draw/sdpropls.cxx
+++ b/xmloff/source/draw/sdpropls.cxx
@@ -77,7 +77,7 @@ using namespace ::xmloff::token;
 #define DPMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_DRAWING_PAGE,context)
 #define TMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_TEXT,context)
 #define PMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_PARAGRAPH,context)
-#define MAP_END() { nullptr, 0, 0, XML_EMPTY, 0 ,0, 
SvtSaveOptions::ODFVER_010, false }
+#define MAP_END() { nullptr, 0, 0, XML_TOKEN_EMPTY, 0 ,0, 
SvtSaveOptions::ODFVER_010, false }
 
 // entry list for graphic properties
 
diff --git a/xmloff/source/style/PageMasterStyleMap.cxx 
b/xmloff/source/style/PageMasterStyleMap.cxx
index 50b90fe35e7b..03c35376486c 100644
--- a/xmloff/source/style/PageMasterStyleMap.cxx
+++ b/xmloff/source/style/PageMasterStyleMap.cxx
@@ -153,7 +153,7 @@ const XMLPropertyMapEntry aXMLPageMasterStyleMap[] =
     PLMAP( "FootnoteLineRelativeWidth", XML_NAMESPACE_STYLE,    XML__EMPTY,    
 XML_TYPE_PERCENT8|MID_FLAG_SPECIAL_ITEM,    CTF_PM_FTN_LINE_WIDTH ),
     PLMAP( "FootnoteLineTextDistance", XML_NAMESPACE_STYLE,    XML__EMPTY,     
XML_TYPE_MEASURE|MID_FLAG_SPECIAL_ITEM,    CTF_PM_FTN_LINE_DISTANCE ),
     PLMAP( "FootnoteLineWeight",        XML_NAMESPACE_STYLE,    
XML_FOOTNOTE_SEP,    XML_TYPE_MEASURE16|MID_FLAG_ELEMENT_ITEM,    
CTF_PM_FTN_LINE_WEIGHT ),
-    PLMAP( "FootnoteLineStyle",     XML_NAMESPACE_STYLE,    XML_EMPTY,  
XML_TYPE_STRING|MID_FLAG_ELEMENT_ITEM,  CTF_PM_FTN_LINE_STYLE ),
+    PLMAP( "FootnoteLineStyle",     XML_NAMESPACE_STYLE,    XML_TOKEN_EMPTY,  
XML_TYPE_STRING|MID_FLAG_ELEMENT_ITEM,  CTF_PM_FTN_LINE_STYLE ),
 
     //////////////////////////////////////////////////////////////////////////
     //Index 92: Section for 'header-style' own section, all members *have* to 
use CTF_PM_HEADERFLAG in the context entry (the 5th one)
@@ -267,7 +267,7 @@ const XMLPropertyMapEntry aXMLPageMasterStyleMap[] =
     HFMAP( "FooterFillBitmapOffsetX",             XML_NAMESPACE_DRAW,     
XML_TILE_REPEAT_OFFSET,     
XML_SW_TYPE_BITMAPREPOFFSETX|MID_FLAG_MULTI_PROPERTY,   
CTF_PM_FOOTERREPEAT_OFFSET_X ),
     HFMAP( "FooterFillBitmapOffsetY",             XML_NAMESPACE_DRAW,     
XML_TILE_REPEAT_OFFSET,     
XML_SW_TYPE_BITMAPREPOFFSETY|MID_FLAG_MULTI_PROPERTY,   
CTF_PM_FOOTERREPEAT_OFFSET_Y ),
 
-    { nullptr, 0, 0, XML_EMPTY, 0, 0, SvtSaveOptions::ODFVER_010, false } // 
index 190
+    { nullptr, 0, 0, XML_TOKEN_EMPTY, 0, 0, SvtSaveOptions::ODFVER_010, false 
} // index 190
 };
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/xmloff/source/table/XMLTableExport.cxx 
b/xmloff/source/table/XMLTableExport.cxx
index 597cf2570a1b..207b1f74307f 100644
--- a/xmloff/source/table/XMLTableExport.cxx
+++ b/xmloff/source/table/XMLTableExport.cxx
@@ -67,7 +67,7 @@ using namespace ::com::sun::star::style;
 #define CMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_TABLE_COLUMN,context)
 #define RMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_TABLE_ROW,context)
 #define CELLMAP(name,prefix,token,type,context) 
MAP_(name,prefix,token,type|XML_TYPE_PROP_TABLE_CELL,context)
-#define MAP_END { nullptr, 0, 0, XML_EMPTY, 0, 0, SvtSaveOptions::ODFVER_010, 
false }
+#define MAP_END { nullptr, 0, 0, XML_TOKEN_EMPTY, 0, 0, 
SvtSaveOptions::ODFVER_010, false }
 
 const XMLPropertyMapEntry* getColumnPropertiesMap()
 {
diff --git a/xmlsecurity/inc/xmlsec-wrapper.h b/xmlsecurity/inc/xmlsec-wrapper.h
index 2d06dcfdd549..b5e142015f75 100644
--- a/xmlsecurity/inc/xmlsec-wrapper.h
+++ b/xmlsecurity/inc/xmlsec-wrapper.h
@@ -29,6 +29,7 @@
 #define XMLSEC_NO_SIZE_T
 #endif
 
+#include <libxml/parser.h>
 #include <xmlsec/base64.h>
 #include <xmlsec/bn.h>
 #include <xmlsec/errors.h>
diff --git a/xmlsecurity/inc/xmlsec/saxhelper.hxx 
b/xmlsecurity/inc/xmlsec/saxhelper.hxx
index e1eed377d6fa..5262b52c81e0 100644
--- a/xmlsecurity/inc/xmlsec/saxhelper.hxx
+++ b/xmlsecurity/inc/xmlsec/saxhelper.hxx
@@ -20,6 +20,7 @@
 #ifndef INCLUDED_XMLSECURITY_INC_XMLSEC_SAXHELPER_HXX
 #define INCLUDED_XMLSECURITY_INC_XMLSEC_SAXHELPER_HXX
 
+#include <libxml/parser.h>
 #include <libxml/tree.h>
 
 #include <rtl/ustring.hxx>
commit 3a5523742e86c428ed8f9d79495460c29adea975
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Jan 3 20:45:14 2024 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    upgrade libxml2, libxslt & liblangtag
    
    what I'm really after is some vexating not-reproducible oss-fuzz msan
    warnings when using libxml2 in the fodt2pdf fuzzer. So lets upgrade
    libxml2 to the latest, which requires bumping libxslt, and then requires
    a newer liblangtag because of no longer implicit includes that it
    depended on.
    
    xmlKeepBlanksDefaultValue and xmlSubstituteEntitiesDefault are
    deprecated, we should get around to updating those uses
    
    Change-Id: I8fda0dffda0a7ea65407d246a3121875cb8ad4a4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161598
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 6875c975f80d8b813b1829a530162869a1e2d92e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163751
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 050a2db3964d5f02e2dd149cb7f76342457a6719)

diff --git a/download.lst b/download.lst
index c2661e5406c0..cf3fcb3ec247 100644
--- a/download.lst
+++ b/download.lst
@@ -150,19 +150,19 @@ export LIBFFI_SHA256SUM := 
72fba7922703ddfa7a028d513ac15a85c8d54c8d67f55fa5a4802
 export LIBFFI_TARBALL := libffi-3.3.tar.gz
 export LIBGPGERROR_SHA256SUM := 
4f93aac6fecb7da2b92871bb9ee33032be6a87b174f54abf8ddf0911a22d29d2
 export LIBGPGERROR_TARBALL := libgpg-error-1.27.tar.bz2
-export LIBLANGTAG_SHA256SUM := 
1f12a20a02ec3a8d22e54dedb8b683a43c9c160bda1ba337bf1060607ae733bd
-export LIBLANGTAG_TARBALL := liblangtag-0.6.3.tar.bz2
+export LIBLANGTAG_SHA256SUM := 
5ed6bcd4ae3f3c05c912e62f216cd1a44123846147f729a49fb5668da51e030e
+export LIBLANGTAG_TARBALL := liblangtag-0.6.7.tar.bz2
 export LIBNUMBERTEXT_SHA256SUM := 
e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7
 export LIBNUMBERTEXT_TARBALL := libnumbertext-1.0.5.tar.xz
 export LIBTOMMATH_SHA256SUM := 
986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee10eae72abed0d1f
 export LIBTOMMATH_TARBALL := ltm-1.2.1.tar.xz
 export XMLSEC_SHA256SUM := 
13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4
 export XMLSEC_TARBALL := xmlsec1-1.2.28.tar.gz
-export LIBXML_SHA256SUM := 
737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7
-export LIBXML_VERSION_MICRO := 4
-export LIBXML_TARBALL := libxml2-2.11.$(LIBXML_VERSION_MICRO).tar.xz
-export LIBXSLT_SHA256SUM := 
8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79
-export LIBXSLT_VERSION_MICRO := 35
+export LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
+export LIBXML_VERSION_MICRO := 5
+export LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
+export LIBXSLT_SHA256SUM := 
2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0
+export LIBXSLT_VERSION_MICRO := 39
 export LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 export LPSOLVE_SHA256SUM := 
171816288f14215c69e730f7a4f1c325739873e21f946ff83884b350574e6695
 export LPSOLVE_TARBALL := 26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz
diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 3c399970cd5b..799044575f9a 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -21,7 +21,7 @@ else # COM=MSC
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,win32/bin.msvc/libxml2.dll))
 endif
 else # OS!=WNT
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.11.$(LIBXML_VERSION_MICRO)))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.12.$(LIBXML_VERSION_MICRO)))
 endif
 endif # DISABLE_DYNLOADING
 
diff --git a/external/libxml2/libxml2-global-symbols.patch 
b/external/libxml2/libxml2-global-symbols.patch
index cbbe5a622284..32146da4b3d7 100644
--- a/external/libxml2/libxml2-global-symbols.patch
+++ b/external/libxml2/libxml2-global-symbols.patch
@@ -13,7 +13,7 @@
  } LIBXML2_2.6.28;
  
  LIBXML2_2.6.32 {
-@@ -2231,3 +2231,49 @@
+@@ -2231,3 +2231,55 @@
    xmlPopOutputCallbacks;
  } LIBXML2_2.9.8;
  
@@ -23,6 +23,12 @@
 +    xmlNewSAXParserCtxt;
 +} LIBXML2_2.9.11;
 +
++LIBXML2_2.12.3 {
++    global:
++    xmlCtxtSetMaxAmplification;
++    xmlTextReaderSetMaxAmplification;
++} LIBXML2_2.11.4;
++
 +# HACK: export global variable accessor functions (globals.h)
 +LIBXML2_GLOBAL_VARIABLES {
 +    global:
diff --git a/filter/source/xsltfilter/LibXSLTTransformer.cxx 
b/filter/source/xsltfilter/LibXSLTTransformer.cxx
index e4e31cdb351f..6eae79675fd2 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.cxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.cxx
@@ -477,7 +477,23 @@ namespace XSLT
         {   // backward compatibility for old clients using createInstance
             params = args;
         }
+
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
         xmlSubstituteEntitiesDefault(0);
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
+
         m_parameters.clear();
         for (int i = 0; i < params.getLength(); i++)
         {
diff --git a/helpcompiler/source/HelpCompiler.cxx 
b/helpcompiler/source/HelpCompiler.cxx
index 70159a2c65fd..0436d9efb461 100644
--- a/helpcompiler/source/HelpCompiler.cxx
+++ b/helpcompiler/source/HelpCompiler.cxx
@@ -44,7 +44,21 @@ HelpCompiler::HelpCompiler(StreamTable &in_streamTable, 
const fs::path &in_input
     src(in_src), zipdir(in_zipdir), module(in_module), lang(in_lang), 
resCompactStylesheet(in_resCompactStylesheet),
     resEmbStylesheet(in_resEmbStylesheet), bExtensionMode( in_bExtensionMode )
 {
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
     xmlKeepBlanksDefaultValue = 0;
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
     char* os = getenv("OS");
     if (os)
     {
diff --git a/xmlsecurity/source/xmlsec/saxhelper.cxx 
b/xmlsecurity/source/xmlsec/saxhelper.cxx
index 1410eb5b0874..8ae3622c24a4 100644
--- a/xmlsecurity/source/xmlsec/saxhelper.cxx
+++ b/xmlsecurity/source/xmlsec/saxhelper.cxx
@@ -118,11 +118,24 @@ SAXHelper::SAXHelper( )
      * compile error:
      * xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS ;
      */
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
     xmlSubstituteEntitiesDefault(0) ;
-
 #ifndef XMLSEC_NO_XSLT
     xmlIndentTreeOutput = 1 ;
 #endif /* XMLSEC_NO_XSLT */
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
 
     m_pParserCtxt = xmlNewParserCtxt() ;
 
commit 53b512eb5c2931949131c5936b8a46cbb976dd33
Author:     Thorsten Behrens <thorsten.behr...@allotropia.de>
AuthorDate: Fri May 17 15:08:38 2024 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    Release 6.3.6.30
    
    Change-Id: Ibc748fa574e6e1c51cf831cb05bd74539a39f659

diff --git a/configure.ac b/configure.ac
index 60aeedba4c1b..4866a9848474 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
 # several non-alphanumeric characters, those are split off and used only for 
the
 # ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no 
idea.
 
-AC_INIT([LibreOffice],[6.3.6.29],[],[],[http://documentfoundation.org/])
+AC_INIT([LibreOffice],[6.3.6.30],[],[],[http://documentfoundation.org/])
 
 dnl libnumbertext needs autoconf 2.68, but that can pick up autoconf268 just 
fine if it is installed
 dnl whereas aclocal (as run by autogen.sh) insists on using autoconf and fails 
hard
commit 44dfa5876eb10702ddc299a5ed570cdeab940cf6
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Oct 20 12:42:10 2021 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:59 2024 +0200

    upgrade liblangtag to 0.6.3
    
    langtag-valencia.patch.0 merged as:
    
https://bitbucket.org/tagoh/liblangtag/commits/fe35532a0b98d5a8179b9edee0d61ea8db9b5921
    
    external/liblangtag/Wformat-overflow.patch redundant since:
    
https://bitbucket.org/tagoh/liblangtag/commits/49135ef561f309078f0bfd6e1f15052769cf75b4
    
    Change-Id: Ieeb19679837f03a6938c97f069d6fb1e6dd9a30d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123890
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 3667da75208e6ccc6deb927555c861ddb3d34dd5)

diff --git a/download.lst b/download.lst
index bb833f09e2f1..c2661e5406c0 100644
--- a/download.lst
+++ b/download.lst
@@ -150,8 +150,8 @@ export LIBFFI_SHA256SUM := 
72fba7922703ddfa7a028d513ac15a85c8d54c8d67f55fa5a4802
 export LIBFFI_TARBALL := libffi-3.3.tar.gz
 export LIBGPGERROR_SHA256SUM := 
4f93aac6fecb7da2b92871bb9ee33032be6a87b174f54abf8ddf0911a22d29d2
 export LIBGPGERROR_TARBALL := libgpg-error-1.27.tar.bz2
-export LIBLANGTAG_SHA256SUM := 
d6242790324f1432fb0a6fae71b6851f520b2c5a87675497cf8ea14c2924d52e
-export LIBLANGTAG_TARBALL := liblangtag-0.6.2.tar.bz2
+export LIBLANGTAG_SHA256SUM := 
1f12a20a02ec3a8d22e54dedb8b683a43c9c160bda1ba337bf1060607ae733bd
+export LIBLANGTAG_TARBALL := liblangtag-0.6.3.tar.bz2
 export LIBNUMBERTEXT_SHA256SUM := 
e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7
 export LIBNUMBERTEXT_TARBALL := libnumbertext-1.0.5.tar.xz
 export LIBTOMMATH_SHA256SUM := 
986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee10eae72abed0d1f
diff --git a/external/liblangtag/UnpackedTarball_liblangtag.mk 
b/external/liblangtag/UnpackedTarball_liblangtag.mk
index cd52b169fa57..5c8ccd944f80 100644
--- a/external/liblangtag/UnpackedTarball_liblangtag.mk
+++ b/external/liblangtag/UnpackedTarball_liblangtag.mk
@@ -28,7 +28,6 @@ endif
 $(eval $(call gb_UnpackedTarball_add_patches,liblangtag, \
        $(if 
$(SYSTEM_LIBXML),,external/liblangtag/langtag-libtool-rpath.patch.0) \
     external/liblangtag/clang-cl.patch.0 \
-    external/liblangtag/langtag-valencia.patch.0 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/liblangtag/langtag-valencia.patch.0 
b/external/liblangtag/langtag-valencia.patch.0
deleted file mode 100644
index dc28043042e4..000000000000
--- a/external/liblangtag/langtag-valencia.patch.0
+++ /dev/null
@@ -1,29 +0,0 @@
---- liblangtag/lt-tag.c
-+++ liblangtag/lt-tag.c
-@@ -2009,11 +2009,23 @@
-       if (ctag->region)
-               lt_string_append_printf(string, "_%s",
-                                       lt_region_get_tag(ctag->region));
--      if (ctag->script) {
-+      if (ctag->script)
-               mod = lt_script_convert_to_modifier(ctag->script);
--              if (mod)
--                      lt_string_append_printf(string, "@%s", mod);
-+      if (!mod && ctag->variants)
-+      {
-+              lt_list_t* l;
-+              for (l = ctag->variants; l != NULL; l = lt_list_next(l)) {
-+                      lt_variant_t *variant = lt_list_value(l);
-+                      const char *s = lt_variant_get_tag(variant);
-+                      if (lt_strcmp0(s, "valencia") == 0) {
-+                              mod = "valencia";
-+                              break;
-+                      }
-+              }
-       }
-+      if (mod)
-+              lt_string_append_printf(string, "@%s", mod);
-+
-       lt_tag_unref(ctag);
- 
-   bail:
diff --git a/solenv/flatpak-manifest.in b/solenv/flatpak-manifest.in
index 37fac861677a..047e29862186 100644
--- a/solenv/flatpak-manifest.in
+++ b/solenv/flatpak-manifest.in
@@ -255,10 +255,11 @@
                     "dest-filename": 
"external/tarballs/language-subtag-registry-2019-09-16.tar.bz2"
                 },
                 {
-                    "url": 
"https://dev-www.libreoffice.org/src/liblangtag-0.6.2.tar.bz2";,
-                    "sha256": 
"d6242790324f1432fb0a6fae71b6851f520b2c5a87675497cf8ea14c2924d52e",
+                    "url": 
"https://dev-www.libreoffice.org/src/liblangtag-0.6.3.tar.bz2";,
+                    "sha256": 
"1f12a20a02ec3a8d22e54dedb8b683a43c9c160bda1ba337bf1060607ae733bd",
                     "type": "file",
-                    "dest-filename": 
"external/tarballs/liblangtag-0.6.2.tar.bz2"
+                    "dest": "external/tarballs",
+                    "dest-filename": "liblangtag-0.6.3.tar.bz2"
                 },
                 {
                     "url": 
"https://dev-www.libreoffice.org/src/libmspub-0.1.4.tar.xz";,
commit 4d9f4f85febaa3c321f243ef45b4d2a813f9c593
Author:     Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Fri May 26 09:13:04 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    external/libxml2: Fix missing external symbols needed by xmllint
    
    After 5b42f148e206cda19467e76c2f9915fc2b6fa5f6 "ExternalProject_libxml2 
still
    needs to build the xmllint executable" (which I had happened to prepare on
    macOS, so didn't originally notice the issue addressed here now), Linux 
builds
    like <https://ci.libreoffice.org/job/lo_callgrind_linux/13374/> started to 
fail
    with
    
    >   CCLD     xmllint
    > /opt/rh/devtoolset-11/root/usr/libexec/gcc/x86_64-redhat-linux/11/ld: 
xmllint-xmllint.o: in function `testSAX':
    > 
/home/tdf/lode/jenkins/workspace/lo_callgrind_linux/workdir/UnpackedTarball/libxml2/xmllint.c:1646:
 undefined reference to `xmlNewSAXParserCtxt'
    > /opt/rh/devtoolset-11/root/usr/libexec/gcc/x86_64-redhat-linux/11/ld: 
xmllint-xmllint.o: in function `myReallocFunc':
    > 
/home/tdf/lode/jenkins/workspace/lo_callgrind_linux/workdir/UnpackedTarball/libxml2/xmllint.c:357:
 undefined reference to `xmlMemSize'
    > collect2: error: ld returned 1 exit status
    > make[2]: *** [Makefile:1007: xmllint] Error 1
    > make[1]: *** 
[/home/tdf/lode/jenkins/workspace/lo_callgrind_linux/external/libxml2/ExternalProject_libxml2.mk:37:
 
/home/tdf/lode/jenkins/workspace/lo_callgrind_linux/workdir/ExternalProject/libxml2/build]
 Error 1
    
    Turns out that those two functions have been introduced after the previously
    used libxml2 2.10.4.  No idea how things are supposed to work (given that
    workdir/UnpackedTarball/libxml2/libxml2.syms starts off with "Retained for
    backward compatibility. Don't add new symbols.", it appears that there 
should be
    some other mechanism at play to make xmllint on Linux find the libxml2.so
    symbols it needs, but which doesn't work as intended in our build), but 
just add
    those two symbols to libxml2.syms for now.  (With a new version named
    LIBXML2_2.11.4, even if the symbols can actually have been introduced in 
some
    other version between 2.10.4 and 2.11.4, but who cares.)
    
    Change-Id: Ib9d5c7901fe94b8014a87b049fc27ef5658fd954
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152292
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 7d9b3393e2632247624d8a1e3129365290d1b60b)

diff --git a/external/libxml2/libxml2-global-symbols.patch 
b/external/libxml2/libxml2-global-symbols.patch
index cfec9c530281..cbbe5a622284 100644
--- a/external/libxml2/libxml2-global-symbols.patch
+++ b/external/libxml2/libxml2-global-symbols.patch
@@ -13,10 +13,16 @@
  } LIBXML2_2.6.28;
  
  LIBXML2_2.6.32 {
-@@ -2231,3 +2231,43 @@
+@@ -2231,3 +2231,49 @@
    xmlPopOutputCallbacks;
  } LIBXML2_2.9.8;
  
++LIBXML2_2.11.4 {
++    global:
++    xmlMemSize;
++    xmlNewSAXParserCtxt;
++} LIBXML2_2.9.11;
++
 +# HACK: export global variable accessor functions (globals.h)
 +LIBXML2_GLOBAL_VARIABLES {
 +    global:
commit 93cbb482b99fcbe24508c69ef9fcfd51c82860fa
Author:     Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Thu May 25 08:21:20 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    ExternalProject_libxml2 still needs to build the xmllint executable
    
    No idea why fd6cbd983a3021d22321854d0414bdc42c6cb1b7 "upgrade to 
libxml2-2.11.4"
    started to only explicitly make libxml2.la (the commit message doesn't 
say), but
    that caused at least <https://ci.libreoffice.org/job/lo_ubsan/2788/> to fail
    with
    
    > make[1]: *** Deleting file 
'/home/tdf/lode/jenkins/workspace/lo_ubsan/workdir/CustomTarget/sfx2/classification/example.validated'
    > [build VAL] CustomTarget/sfx2/classification/example.validated
    > /bin/sh: 
/home/tdf/lode/jenkins/workspace/lo_ubsan/workdir/UnpackedTarball/libxml2//xmllint:
 No such file or directory
    > make[1]: *** 
[/home/tdf/lode/jenkins/workspace/lo_ubsan/sfx2/CustomTarget_classification.mk:20:
 
/home/tdf/lode/jenkins/workspace/lo_ubsan/workdir/CustomTarget/sfx2/classification/example.validated]
 Error 1
    
    Change-Id: I7e7aa2bae05cf8674720cfd72c78840cd7a28919
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152256
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 5b42f148e206cda19467e76c2f9915fc2b6fa5f6)

diff --git a/external/libxml2/ExternalProject_libxml2.mk 
b/external/libxml2/ExternalProject_libxml2.mk
index aea6ec2423c6..5a044e3098dd 100644
--- a/external/libxml2/ExternalProject_libxml2.mk
+++ b/external/libxml2/ExternalProject_libxml2.mk
@@ -36,7 +36,7 @@ $(call gb_ExternalProject_get_state_target,libxml2,build):
                        LDFLAGS="$(if $(SYSBASE),-L$(SYSBASE)/usr/lib)" \
                        CFLAGS="$(if $(SYSBASE),-I$(SYSBASE)/usr/include) $(if 
$(debug),-g)" \
                        $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
-               && $(MAKE) libxml2.la \
+               && $(MAKE) libxml2.la xmllint \
        )
 endif
 
commit 377d412305e9a8e7f8a151dc4221ae2e4aa33cc2
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue May 23 21:15:52 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    upgrade to libxml2-2.11.4
    
    'checked' field removed with:
    
https://gitlab.gnome.org/GNOME/libxml2/-/commit/ce76ebfd1312459951d555ad9d87fb9a89eede55
    
    win32 'run_debug' removed with:
    
https://gitlab.gnome.org/GNOME/libxml2/-/commit/59f2f60e3eff07324f1c7cd861a444d714be750b
    
    add libxml2-XMLCALL-redefine.patch.0 to avoid:
    UnpackedTarball\libxml2\include\libxml/xmlexports.h(41): error C2220: the 
following warning is treated as an error
    UnpackedTarball\libxml2\include\libxml/xmlexports.h(41): warning C4005: 
'XMLCALL': macro redefinition
    UnpackedTarballxpat\libxpat_external.h(69): note: see previous definition 
of 'XMLCALL'
    
    Change-Id: Ia9b1540dc1b4eccf91662c8d995c036f71de6fc6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152176
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit fd6cbd983a3021d22321854d0414bdc42c6cb1b7)

diff --git a/download.lst b/download.lst
index 1f25350dfcb2..bb833f09e2f1 100644
--- a/download.lst
+++ b/download.lst
@@ -158,9 +158,9 @@ export LIBTOMMATH_SHA256SUM := 
986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee
 export LIBTOMMATH_TARBALL := ltm-1.2.1.tar.xz
 export XMLSEC_SHA256SUM := 
13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4
 export XMLSEC_TARBALL := xmlsec1-1.2.28.tar.gz
-export LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
-export LIBXML_VERSION_MICRO := 5
-export LIBXML_TARBALL := libxml2-2.10.$(LIBXML_VERSION_MICRO).tar.xz
+export LIBXML_SHA256SUM := 
737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7
+export LIBXML_VERSION_MICRO := 4
+export LIBXML_TARBALL := libxml2-2.11.$(LIBXML_VERSION_MICRO).tar.xz
 export LIBXSLT_SHA256SUM := 
8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79
 export LIBXSLT_VERSION_MICRO := 35
 export LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 6338fb20b9df..3c399970cd5b 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -21,7 +21,7 @@ else # COM=MSC
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,win32/bin.msvc/libxml2.dll))
 endif
 else # OS!=WNT
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.10.$(LIBXML_VERSION_MICRO)))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.11.$(LIBXML_VERSION_MICRO)))
 endif
 endif # DISABLE_DYNLOADING
 
diff --git a/external/libxml2/ExternalProject_libxml2.mk 
b/external/libxml2/ExternalProject_libxml2.mk
index 0d8559dfb04f..aea6ec2423c6 100644
--- a/external/libxml2/ExternalProject_libxml2.mk
+++ b/external/libxml2/ExternalProject_libxml2.mk
@@ -21,7 +21,7 @@ $(eval $(call gb_ExternalProject_use_nmake,libxml2,build))
 $(call gb_ExternalProject_get_state_target,libxml2,build):
        $(call gb_ExternalProject_run,build,\
                cscript /e:javascript configure.js \
-                       iconv=no icu=yes sax1=yes $(if 
$(MSVC_USE_DEBUG_RUNTIME),run_debug=yes cruntime=/MDd) \
+                       iconv=no icu=yes sax1=yes $(if 
$(MSVC_USE_DEBUG_RUNTIME),cruntime=/MDd) \
                        $(if $(filter TRUE,$(ENABLE_DBGUTIL)),debug=yes) \
                && nmake \
        ,win32)
@@ -36,7 +36,7 @@ $(call gb_ExternalProject_get_state_target,libxml2,build):
                        LDFLAGS="$(if $(SYSBASE),-L$(SYSBASE)/usr/lib)" \
                        CFLAGS="$(if $(SYSBASE),-I$(SYSBASE)/usr/include) $(if 
$(debug),-g)" \
                        $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
-               && $(MAKE) \
+               && $(MAKE) libxml2.la \
        )
 endif
 
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 4ec3fa074dea..3970cd26fb76 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -16,6 +16,7 @@ $(eval $(call 
gb_UnpackedTarball_update_autoconf_configs,libxml2))
 $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        external/libxml2/libxml2-global-symbols.patch \
        external/libxml2/libxml2-vc10.patch \
+       external/libxml2/libxml2-XMLCALL-redefine.patch.0 \
        $(if $(filter ANDROID,$(OS)),external/libxml2/libxml2-android.patch) \
        external/libxml2/libxml2-icu.patch.0 \
 ))
diff --git a/external/libxml2/libxml2-XMLCALL-redefine.patch.0 
b/external/libxml2/libxml2-XMLCALL-redefine.patch.0
new file mode 100644
index 000000000000..d9ca23be7ce4
--- /dev/null
+++ b/external/libxml2/libxml2-XMLCALL-redefine.patch.0
@@ -0,0 +1,11 @@
+--- include/libxml/xmlexports.h        2023-05-24 12:48:46.179570708 +0100
++++ include/libxml/xmlexports.h        2023-05-24 12:48:56.563577488 +0100
+@@ -38,8 +38,6 @@
+ 
+ /** DOC_DISABLE */
+ /* Compatibility */
+-#define XMLCALL
+-#define XMLCDECL
+ #if !defined(LIBXML_DLL_IMPORT)
+ #define LIBXML_DLL_IMPORT XMLPUBVAR
+ #endif
diff --git a/external/libxml2/libxml2-icu-sym.patch.0 
b/external/libxml2/libxml2-icu-sym.patch.0
new file mode 100644
index 000000000000..07676228da19
--- /dev/null
+++ b/external/libxml2/libxml2-icu-sym.patch.0
@@ -0,0 +1,37 @@
+Find bundled ICU in workdir and use debug .libs when needed
+
+diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
+--- win32/Makefile.msvc.dt     2014-07-18 19:00:23.372103963 +0200
++++ win32/Makefile.msvc        2014-07-18 19:01:39.347982929 +0200
+@@ -46,6 +46,7 @@ CPPFLAGS = $(CPPFLAGS) /D "_REENTRANT"
+ CC = cl.exe
+ CFLAGS = /nologo /D "_WINDOWS" /D "_MBCS" /D "NOLIBTOOL" /W3 /wd4244 /wd4267 
$(CRUNTIME)
+ CFLAGS = $(CFLAGS) /I$(XML_SRCDIR) /I$(XML_SRCDIR)\include /I$(INCPREFIX)
++CFLAGS = $(CFLAGS) /I$(WORKDIR)/UnpackedTarball/icu/source/i18n 
/I$(WORKDIR)/UnpackedTarball/icu/source/common
+ !if "$(WITH_THREADS)" != "no"
+ CFLAGS = $(CFLAGS) /D "_REENTRANT"
+ !endif
+@@ -62,7 +63,9 @@
+ # The linker and its options.
+ LD = link.exe
+ LDFLAGS = /nologo /VERSION:$(LIBXML_MAJOR_VERSION).$(LIBXML_MINOR_VERSION)
++LDFLAGS = $(LDFLAGS) /LIBPATH:$(WORKDIR)/UnpackedTarball/icu/source/lib
+ LDFLAGS = $(LDFLAGS) /LIBPATH:$(BINDIR) /LIBPATH:$(LIBPREFIX)
++LDFLAGS = $(LDFLAGS) /DEBUG /OPT:REF
+ LIBS =
+ !if "$(WITH_FTP)" == "1" || "$(WITH_HTTP)" == "1"
+ LIBS = $(LIBS) wsock32.lib ws2_32.lib
+@@ -74,9 +77,13 @@
+ !if "$(STATIC)" == "1"
+ LIBS = $(LIBS) advapi32.lib sicuuc.lib sicuin.lib sicudt.lib
+ !else
++!if "$(DEBUG)" == "1"
++LIBS = $(LIBS) icuind.lib icuucd.lib icudtd.lib
++!else
+ LIBS = $(LIBS) icuuc.lib icuin.lib icudt.lib
+ !endif
+ !endif
++!endif
+ !if "$(WITH_ZLIB)" == "1"
+ # could be named differently zdll or zlib
+ # LIBS = $(LIBS) zdll.lib
diff --git a/external/libxml2/libxml2-icu.patch.0 
b/external/libxml2/libxml2-icu.patch.0
index b390b03d8787..84197763f878 100644
--- a/external/libxml2/libxml2-icu.patch.0
+++ b/external/libxml2/libxml2-icu.patch.0
@@ -23,7 +23,7 @@ diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
  !if "$(STATIC)" == "1"
  LIBS = $(LIBS) advapi32.lib sicuuc.lib sicuin.lib sicudt.lib
  !else
-+!if "$(WITH_RUN_DEBUG)" == "1"
++!if "$(DEBUG)" == "1"
 +LIBS = $(LIBS) icuind.lib icuucd.lib icudtd.lib
 +!else
  LIBS = $(LIBS) icuuc.lib icuin.lib icudt.lib
diff --git a/external/redland/UnpackedTarball_raptor.mk 
b/external/redland/UnpackedTarball_raptor.mk
index fbdc8b6f5510..92bc586a3e60 100644
--- a/external/redland/UnpackedTarball_raptor.mk
+++ b/external/redland/UnpackedTarball_raptor.mk
@@ -30,6 +30,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,raptor,\
        
external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1
 \
        
external/redland/raptor/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch.1
 \
        external/redland/raptor/libtool.patch \
+       external/redland/raptor/raptor-libxml2-11.patch.1 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/redland/raptor/raptor-libxml2-11.patch.1 
b/external/redland/raptor/raptor-libxml2-11.patch.1
new file mode 100644
index 000000000000..9bed29e50d0b
--- /dev/null
+++ b/external/redland/raptor/raptor-libxml2-11.patch.1
@@ -0,0 +1,15 @@
+--- raptor/src/raptor_libxml.c 2023-05-24 09:55:21.589275008 +0100
++++ raptor/src/raptor_libxml.c 2023-05-24 09:56:41.100324810 +0100
+@@ -246,9 +246,11 @@
+     
+     ret->owner = 1;
+ 
+-#if LIBXML_VERSION >= 20627
++#if LIBXML_VERSION >= 20627 && LIBXML_VERSION < 21100
+     /* Checked field was released in 2.6.27 on 2006-10-25
+      * 
http://git.gnome.org/browse/libxml2/commit/?id=a37a6ad91a61d168ecc4b29263def3363fff4da6
++     * and removed with
++     * 
https://gitlab.gnome.org/GNOME/libxml2/-/commit/ce76ebfd1312459951d555ad9d87fb9a89eede55
+      *
+      */
+ 
commit a2e4dabe5699d7e1db3eae1d237cab906f419758
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Mar 27 17:07:20 2024 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    add notify for script use
    
    Change-Id: I84af197cec7755f6803a578e1e21c03966ad5f3e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165412
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/xmloff/source/draw/eventimp.cxx b/xmloff/source/draw/eventimp.cxx
index bfeb15bc25e3..82bd9d4cc0aa 100644
--- a/xmloff/source/draw/eventimp.cxx
+++ b/xmloff/source/draw/eventimp.cxx
@@ -243,6 +243,9 @@ SdXMLEventContext::SdXMLEventContext( SvXMLImport& rImp,  
sal_uInt16 nPrfx, cons
 
     if( mbValid )
         mbValid = !sEventName.isEmpty();
+
+    if (!msMacroName.isEmpty())
+        rImp.NotifyMacroEventRead();
 }
 
 SvXMLImportContextRef SdXMLEventContext::CreateChildContext( sal_uInt16 
nPrefix, const OUString& rLocalName, const Reference< XAttributeList>& 
xAttrList )
commit dc3ccc5bf5d1c38b919266834687966736a8a8c4
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Wed Mar 20 10:52:09 2024 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    python3: upgrade to release 3.8.19
    
    Fixes CVE-2023-6597 and also CVE-2024-0450
    
    Change-Id: Iebca2608e16a966356736201c63f1be5185430d4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165053
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 0633e4b4205334dd65ec64d7f3e306ee125e31be)

diff --git a/configure.ac b/configure.ac
index 6eaa84a61cbd..60aeedba4c1b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8750,7 +8750,7 @@ internal)
     SYSTEM_PYTHON=
     PYTHON_VERSION_MAJOR=3
     PYTHON_VERSION_MINOR=8
-    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.18
+    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.19
     if ! grep -q -i python.*${PYTHON_VERSION} ${SRC_ROOT}/download.lst; then
         AC_MSG_ERROR([PYTHON_VERSION ${PYTHON_VERSION} but no matching file in 
download.lst])
     fi
diff --git a/download.lst b/download.lst
index eff3bf76faab..1f25350dfcb2 100644
--- a/download.lst
+++ b/download.lst
@@ -212,8 +212,8 @@ export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb3
 export POPPLER_TARBALL := poppler-22.09.0.tar.xz
 export POSTGRESQL_SHA256SUM := 
5bbcf5a56d85c44f3a8b058fb46862ff49cbc91834d07e295d02e6de3c216df2
 export POSTGRESQL_TARBALL := postgresql-13.10.tar.bz2
-PYTHON_SHA256SUM := 
3ffb71cd349a326ba7b2fadc7e7df86ba577dd9c4917e52a8401adbda7405e3f
-PYTHON_TARBALL := Python-3.8.18.tar.xz
+PYTHON_SHA256SUM := 
d2807ac69f69b84fd46a0b93bbd02a4fa48d3e70f4b2835ff0f72a2885040076
+PYTHON_TARBALL := Python-3.8.19.tar.xz
 export QXP_SHA256SUM := 
e137b6b110120a52c98edd02ebdc4095ee08d0d5295a94316a981750095a945c
 export QXP_TARBALL := libqxp-0.0.2.tar.xz
 export RAPTOR_SHA256SUM := 
ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed
commit 2370575f33910474a6b661fbeff55e40d2b62cb1
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Thu Feb 22 11:57:37 2024 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    libxml2: upgrade to release 2.12.5
    
    Fixes CVE-2024-25062
    
    Change-Id: I0e98fd919328e9633a602c4872de0b06eb972cc0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163734
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 4c3ee61e3eda0cbfd812443f80af89aa3a24ac73)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163753
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit ca089311678ca6f84771c145178bf4153243ed45)

diff --git a/download.lst b/download.lst
index 9c287ceab04b..eff3bf76faab 100644
--- a/download.lst
+++ b/download.lst
@@ -158,8 +158,8 @@ export LIBTOMMATH_SHA256SUM := 
986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee
 export LIBTOMMATH_TARBALL := ltm-1.2.1.tar.xz
 export XMLSEC_SHA256SUM := 
13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4
 export XMLSEC_TARBALL := xmlsec1-1.2.28.tar.gz
-export LIBXML_SHA256SUM := 
ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45
-export LIBXML_VERSION_MICRO := 4
+export LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
+export LIBXML_VERSION_MICRO := 5
 export LIBXML_TARBALL := libxml2-2.10.$(LIBXML_VERSION_MICRO).tar.xz
 export LIBXSLT_SHA256SUM := 
8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79
 export LIBXSLT_VERSION_MICRO := 35
commit 46f792e5d71cc002531cdcb871055d9aa55caa99
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Feb 16 10:34:54 2024 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    nss: upgrade to release 3.98
    
    Fixes CVE-2023-5388
    
    Also update README, and remove obsolete documentation of Debian's
    mangled SONAME; relevant Debian changelog:
    
      nss (2:3.13.4-2) unstable; urgency=low
    
      * debian/control, debian/libnss3*, debian/rules,
        mozilla/security/coreconf/*, mozilla/security/nss/lib/*/manifest.mn:
        Move to unversioned library. ABI compatibility is ensured upstream, and
        the SO version, if it needed a change at any time, would be a change in
        the library name. There is no reason to keep making compatibility more
        difficult with other distros and upstream binary releases. While 
previous
        versions were one-way compatible (binaries built against other distros 
or
        upstream nspr could work on Debian), this approach works both ways.
    
      -- Mike Hommey <gland...@debian.org>  Thu, 17 May 2012 09:45:36 +0200
    
    Change-Id: Ifc1eae68827fa88ae001a3903c8555af67b488ac
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163494
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
    (cherry picked from commit cd94b0af38d712fa6eb0e0f43ce13ac6e72535d9)

diff --git a/download.lst b/download.lst
index d6fb138e1f6e..9c287ceab04b 100644
--- a/download.lst
+++ b/download.lst
@@ -183,8 +183,8 @@ export MYTHES_SHA256SUM := 
1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_SHA256SUM := 
db0bd8cdec329b48f53a6f00199c92d5ba40b0f015b153718d1b15d3d967fbca
 export NEON_TARBALL := neon-0.30.2.tar.gz
-export NSS_SHA256SUM := 
fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a
-export NSS_TARBALL := nss-3.88.1-with-nspr-4.35.tar.gz
+export NSS_SHA256SUM := 
59bb55a59b02e4004fc26ad0aa1a13fe8d73c6c90c447dd2f2efb73fb81083ed
+export NSS_TARBALL := nss-3.98-with-nspr-4.35.tar.gz
 export ODFGEN_SHA256SUM := 
2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2
 export ODFGEN_VERSION_MICRO := 6
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2
diff --git a/external/nss/README b/external/nss/README
index 6997cea6ca06..09931f64ea20 100644
--- a/external/nss/README
+++ b/external/nss/README
@@ -1,5 +1,16 @@
 Contains the Network Security Services (NSS) libraries from Mozilla
 
+== ESR versions ==
+
+Upstream releases both regular and "ESR" versions, the latter go into Firefox
+ESR and Thunderbird.
+
+There is a new ESR version about once a year, and a ESR version gets micro
+updates only when there are security issues to fix, and it's not always obvious
+from the release notes of a regular release if there are security issues that
+are relevant to LibreOffice, hence it's probably best to bundle only the ESR
+versions and upgrade for every micro release (as recommended by upstream).
+
 == Fips 140 and signed libraries ==
 
 Fips 140 mode is not supported. That is, the *.chk files containing the
@@ -20,18 +31,3 @@ With all supported macOS SDK we use
 NSS_USE_SYSTEM_SQLITE=1
 to build using the system sqlite.
 
-== system NSS on Linux ==
-
-Note that different Linux distributions use different SONAMEs for the
-NSS libraries, so it is not possible to use --with-system-nss and build
-a portable generic LO installation set, despite NSS upstream apparently
-maintaining ABI compatibility.
-
-Debian Squeeze:
-0x000000000000000e (SONAME)             Library soname: [libnss3.so.1d]
-Fedora 20:
-0x000000000000000e (SONAME)             Library soname: [libnss3.so]
-
-For the record, the LSB specified SONAME is libnss3.so
-http://refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-generic/LSB-Core-generic/libnss3.html
-
commit 97b5d4f67ca3ede8f7b4d39ce4a9fe033e10f9a6
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Mon Dec 11 13:13:23 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    curl: add patch for CVE-2023-46218
    
    Change-Id: I215bcc26b87d638189423eeaaa6c5b8d5b146bd4
    (cherry picked from commit 2eba604fdae1bf5b8432b764b3cafe5072cc5fe6)

diff --git a/external/curl/2b0994c29a721c91c57.patch 
b/external/curl/2b0994c29a721c91c57.patch
new file mode 100644
index 000000000000..0bcc24c06aa5
--- /dev/null
+++ b/external/curl/2b0994c29a721c91c57.patch
@@ -0,0 +1,48 @@
+From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <dan...@haxx.se>
+Date: Thu, 23 Nov 2023 08:15:47 +0100
+Subject: [PATCH] cookie: lowercase the domain names before PSL checks
+
+Reported-by: Harry Sintonen
+
+Closes #12387
+---
+ lib/cookie.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 568cf537ad1b1..9095cea3e97f2 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data,
+    * dereference it.
+    */
+   if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) {
+-    const psl_ctx_t *psl = Curl_psl_use(data);
+-    int acceptable;
+-
+-    if(psl) {
+-      acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
+-      Curl_psl_release(data);
++    bool acceptable = FALSE;
++    char lcase[256];
++    char lcookie[256];
++    size_t dlen = strlen(domain);
++    size_t clen = strlen(co->domain);
++    if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
++      const psl_ctx_t *psl = Curl_psl_use(data);
++      if(psl) {
++        /* the PSL check requires lowercase domain name and pattern */
++        Curl_strntolower(lcase, domain, dlen + 1);
++        Curl_strntolower(lcookie, co->domain, clen + 1);
++        acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
++        Curl_psl_release(data);
++      }
++      else
++        acceptable = !bad_domain(domain, strlen(domain));
+     }
+-    else
+-      acceptable = !bad_domain(domain, strlen(domain));
+ 
+     if(!acceptable) {
+       infof(data, "cookie '%s' dropped, domain '%s' must not "
diff --git a/external/curl/UnpackedTarball_curl.mk 
b/external/curl/UnpackedTarball_curl.mk
index 960e1f848302..a8ac5b77c8ee 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -23,6 +23,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\
        external/curl/curl-7.26.0_win-proxy.patch \
        external/curl/zlib.patch.0 \
        external/curl/CVE-2023-38545_7.87.0.patch \
+       external/curl/2b0994c29a721c91c57.patch \
 ))
 
 ifeq ($(SYSTEM_NSS),)
commit db3af1a0d999d82e546d6498119dac3d48be5f7f
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Nov 22 21:14:41 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    reuse AllowedLinkProtocolFromDocument in impress/draw
    
    Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159884
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sd/source/ui/app/sdmod1.cxx b/sd/source/ui/app/sdmod1.cxx
index 2949cdad454d..e218ffd98551 100644
--- a/sd/source/ui/app/sdmod1.cxx
+++ b/sd/source/ui/app/sdmod1.cxx
@@ -32,6 +32,7 @@
 #include <sfx2/dispatch.hxx>
 #include <sfx2/request.hxx>
 #include <sfx2/templatedlg.hxx>
+#include <svl/stritem.hxx>
 #include <editeng/eeitem.hxx>
 
 #include <svx/svxids.hrc>
@@ -193,26 +194,32 @@ void SdModule::Execute(SfxRequest& rReq)
         {
             bool bIntercept = false;
             ::sd::DrawDocShell* pDocShell = dynamic_cast< ::sd::DrawDocShell 
*>( SfxObjectShell::Current() );
-            if (pDocShell)
+            ::sd::ViewShell* pViewShell = pDocShell ? 
pDocShell->GetViewShell() : nullptr;
+            if (pViewShell)
             {
-                ::sd::ViewShell* pViewShell = pDocShell->GetViewShell();
-                if (pViewShell)
+                if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) 
)
                 {
-                    if( sd::SlideShow::IsRunning( 
pViewShell->GetViewShellBase() ) )
+                    // Prevent documents from opening while the slide
+                    // show is running, except when this request comes
+                    // from a shape interaction.
+                    if (rReq.GetArgs() == nullptr)
                     {
-                        // Prevent documents from opening while the slide
-                        // show is running, except when this request comes
-                        // from a shape interaction.
-                        if (rReq.GetArgs() == nullptr)
-                        {
-                            bIntercept = true;
-                        }
+                        bIntercept = true;
                     }
                 }
             }
 
             if (!bIntercept)
             {
+                if (const SfxStringItem* pURLItem = 
rReq.GetArg<SfxStringItem>(SID_FILE_NAME))
+                {
+                    if (!pViewShell || 
!SfxObjectShell::AllowedLinkProtocolFromDocument(pURLItem->GetValue(),
+                                                                               
         pViewShell->GetObjectShell(),
+                                                                               
         pViewShell->GetFrameWeld()))
+                    {
+                        return;
+                    }
+                }
                 SfxGetpApp()->ExecuteSlot(rReq, SfxGetpApp()->GetInterface());
             }
             else
commit 9b1ae8aae0d9d86f10ba7a34072e19f30c0d8b44
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Nov 15 11:39:24 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    reuse AllowedLinkProtocolFromDocument in writer
    
    reorg calc hyperlink check to reuse elsewhere
    
    Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)
    
    reuse AllowedLinkProtocolFromDocument in writer
    
    Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
    Tested-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)
    
    combine these hyperlink dispatchers into one call
    
    Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
    Tested-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)
    
    we can have just one LoadURL for writer
    
    Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)

diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
index f93610e3adcd..af6c4476ef32 100644
--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
@@ -201,6 +201,9 @@ private:
 
     SAL_DLLPRIVATE bool SaveTo_Impl(SfxMedium &rMedium, const SfxItemSet* pSet 
);
 
+    // true if the document had macros (or similar) on load to trigger warning 
user
+    SAL_DLLPRIVATE bool  GetHadCheckedMacrosOnLoad() const;
+
 protected:
                                 SfxObjectShell(SfxObjectCreateMode);
                                 SfxObjectShell(SfxModelFlags);    // see 
sfxmodelfactory.hxx
@@ -424,8 +427,8 @@ public:
     void                        SetMacroCallsSeenWhileLoading();
     bool                        GetMacroCallsSeenWhileLoading() const;
 
-    // true if the document had macros (or similar) on load to trigger warning 
user
-    bool                        GetHadCheckedMacrosOnLoad() const;
+    // true if this type of link, from a document, is allowed by the user to 
be passed to uno:OpenDoc
+    static bool                 AllowedLinkProtocolFromDocument(const 
OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent);
 
     const css::uno::Sequence< css::beans::PropertyValue >& 
GetModifyPasswordInfo() const;
     bool                        SetModifyPasswordInfo( const 
css::uno::Sequence< css::beans::PropertyValue >& aInfo );
diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
index 79637466b22e..9095646160ce 100644
--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
@@ -27,9 +27,7 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/dispatch.hxx>
 #include <sfx2/objsh.hxx>
-#include <sfx2/sfxresid.hxx>
 #include <sfx2/sfxsids.hrc>
-#include <sfx2/strings.hrc>
 #include <sfx2/viewfrm.hxx>
 #include <sfx2/viewsh.hxx>
 #include <svl/stritem.hxx>
@@ -838,34 +836,8 @@ void ScGlobal::OpenURL(const OUString& rURL, const 
OUString& rTarget)
             aUrlName = aNewUrlName;
     }
 
-    if (INetURLObject(aUrlName).IsExoticProtocol())
-    {
-        // Default to ignoring exotic protocols
-        bool bAllow = false;
-        if (pObjShell)
-        {
-            // If the document had macros when loaded then follow the allowed 
macro-mode
-            if (pObjShell->GetHadCheckedMacrosOnLoad())
-                bAllow = pObjShell->AdjustMacroMode();
-            else // otherwise ask the user, defaulting to cancel
-            {
-                assert(pFrame && "if we have pObjShell we have pFrame");
-                //Reuse URITools::onOpenURI warning string
-                std::unique_ptr<weld::MessageDialog> 
xQueryBox(Application::CreateMessageDialog(pFrame->GetWindow().GetFrameWeld(),
-                                                               
VclMessageType::Warning, VclButtonsType::YesNo,
-                                                               
SfxResId(STR_DANGEROUS_TO_OPEN)));
-                
xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
-                    INetURLObject::decode(aUrlName, 
INetURLObject::DecodeMechanism::Unambiguous)));
-                xQueryBox->set_default_response(RET_NO);
-                bAllow = xQueryBox->run() == RET_YES;
-            }
-        }
-        if (!bAllow)
-        {
-            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
-            return;
-        }
-    }
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, 
pFrame ? pFrame->GetWindow().GetFrameWeld() : nullptr))
+        return;
 
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 994f6298074f..e0fbc9e09d72 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -933,7 +933,6 @@ void SfxObjectShell::CheckSecurityOnLoading_Impl()
     CheckEncryption_Impl( xInteraction );
 
     // check macro security
-    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction );
     const bool bHasMacros = pImpl->aMacroMode.hasMacros();
     pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasMacros );
     pImpl->m_bHadCheckedMacrosOnLoad = bHasMacros;
@@ -944,6 +943,33 @@ bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
     return pImpl->m_bHadCheckedMacrosOnLoad;
 }
 
+bool SfxObjectShell::AllowedLinkProtocolFromDocument(const OUString& rUrl, 
SfxObjectShell* pObjShell, weld::Window* pDialogParent)
+{
+    if (!INetURLObject(rUrl).IsExoticProtocol())
+        return true;
+    // Default to ignoring exotic protocols
+    bool bAllow = false;
+    if (pObjShell)
+    {
+        // If the document had macros when loaded then follow the allowed 
macro-mode
+        if (pObjShell->GetHadCheckedMacrosOnLoad())
+            bAllow = pObjShell->AdjustMacroMode();
+        else // otherwise ask the user, defaulting to cancel
+        {
+            //Reuse URITools::onOpenURI warning string
+            std::unique_ptr<weld::MessageDialog> 
xQueryBox(Application::CreateMessageDialog(pDialogParent,
+                                                           
VclMessageType::Warning, VclButtonsType::YesNo,
+                                                           
SfxResId(STR_DANGEROUS_TO_OPEN)));
+            
xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+                INetURLObject::decode(rUrl, 
INetURLObject::DecodeMechanism::Unambiguous)));
+            xQueryBox->set_default_response(RET_NO);
+            bAllow = xQueryBox->run() == RET_YES;
+        }
+    }
+    SAL_WARN_IF(!bAllow, "sfx.appl", 
"SfxObjectShell::AllowedLinkProtocolFromDocument ignoring: " << rUrl);
+    return bAllow;
+}
+
 void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< 
task::XInteractionHandler >& xHandler )
 {
     OUString aVersion;
diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx 
b/sw/source/uibase/wrtsh/wrtsh2.cxx
index 8897fe213130..a3d27216e490 100644
--- a/sw/source/uibase/wrtsh/wrtsh2.cxx
+++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
@@ -472,15 +472,14 @@ bool SwWrtShell::ClickToINetGrf( const Point& rDocPt, 
LoadUrlFlags nFilter )
     return bRet;
 }
 
-void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
-              const OUString& rTargetFrameName )
+static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
+                    const OUString& rTargetFrameName)
 {
-    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
-    if( rURL.isEmpty() )
-        return ;
+    SwDocShell* pDShell = rView.GetDocShell();
+    OSL_ENSURE( pDShell, "No DocShell?!");
+    SfxViewFrame* pViewFrame = rView.GetViewFrame();
 
-    // The shell could be 0 also!!!!!
-    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, 
pViewFrame->GetWindow().GetFrameWeld()))
         return;
 
     OUString sFileURL = rURL;
@@ -508,11 +507,6 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, 
LoadUrlFlags nFilter,
         return;
     }
 
-    //A CursorShell is always a WrtShell
-    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
-
-    SwDocShell* pDShell = rSh.GetView().GetDocShell();
-    OSL_ENSURE( pDShell, "No DocShell?!");
     OUString sTargetFrame(rTargetFrameName);
     if (sTargetFrame.isEmpty() && pDShell)
     {
@@ -527,7 +521,6 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, 
LoadUrlFlags nFilter,
     OUString sReferer;
     if( pDShell && pDShell->GetMedium() )
         sReferer = pDShell->GetMedium()->GetName();
-    SfxViewFrame* pViewFrame = rSh.GetView().GetViewFrame();
     SfxFrameItem aView( SID_DOCFRAME, pViewFrame );
     SfxStringItem aName( SID_FILE_NAME, sFileURL );
     SfxStringItem aTargetFrameName( SID_TARGETNAME, sTargetFrame );
@@ -553,6 +546,23 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, 
LoadUrlFlags nFilter,
             SfxCallMode::ASYNCHRON|SfxCallMode::RECORD );
 }
 
+void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+              const OUString& rTargetFrameName )
+{
+    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
+    if( rURL.isEmpty() )
+        return ;
+
+    // The shell could be 0 also!!!!!
+    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+        return;
+
+    //A CursorShell is always a WrtShell
+    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
+
+    ::LoadURL(rSh.GetView(), rURL, nFilter, rTargetFrameName);
+}
+
 void SwWrtShell::NavigatorPaste( const NaviContentBookmark& rBkmk,
                                     const sal_uInt16 nAction )
 {
commit ba9ebef21f166ad39b7528336f5f3f9c5e21481e
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Fri Nov 3 17:26:25 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    default to ignoring libreoffice special-purpose protocols in calc hyperlink
    
    Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159045
    Reviewed-by: Eike Rathke <er...@redhat.com>
    (cherry picked from commit 672716d09c54cb6fdd59baa7da4b8393cf104cd2)

diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx 
b/dbaccess/source/core/dataaccess/ModelImpl.cxx
index 9958b6c0e995..6313cc12590b 100644
--- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
+++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
@@ -1048,7 +1048,8 @@ bool ODatabaseModelImpl::checkMacrosOnLoading()
 {
     Reference< XInteractionHandler > xInteraction;
     xInteraction = m_aMediaDescriptor.getOrDefault( "InteractionHandler", 
xInteraction );
-    return m_aMacroMode.checkMacrosOnLoading( xInteraction );
+    const bool bHasMacros = m_aMacroMode.hasMacros();
+    return m_aMacroMode.checkMacrosOnLoading(xInteraction, bHasMacros);
 }
 
 void ODatabaseModelImpl::resetMacroExecutionMode()
diff --git a/include/sfx2/docmacromode.hxx b/include/sfx2/docmacromode.hxx
index a15bbbe9ba56..98b7d3a990ea 100644
--- a/include/sfx2/docmacromode.hxx
+++ b/include/sfx2/docmacromode.hxx
@@ -260,6 +260,8 @@ namespace sfx2
         */
         static bool storageHasMacros( const css::uno::Reference< 
css::embed::XStorage >& _rxStorage );
 
+        bool hasMacros() const;
+
         static bool containerHasBasicMacros( const css::uno::Reference< 
css::script::XLibraryContainer >& xContainter );
         /** checks the macro execution mode while loading the document.
 
@@ -286,7 +288,8 @@ namespace sfx2
         */
         bool
                 checkMacrosOnLoading(
-                    const css::uno::Reference< css::task::XInteractionHandler 
>& _rxInteraction
+                    const css::uno::Reference< css::task::XInteractionHandler 
>& _rxInteraction,
+                    bool bHasMacros
                 );
 
     private:
diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
index 35210463240e..f93610e3adcd 100644
--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
@@ -424,6 +424,9 @@ public:
     void                        SetMacroCallsSeenWhileLoading();
     bool                        GetMacroCallsSeenWhileLoading() const;
 
+    // true if the document had macros (or similar) on load to trigger warning 
user
+    bool                        GetHadCheckedMacrosOnLoad() const;
+
     const css::uno::Sequence< css::beans::PropertyValue >& 
GetModifyPasswordInfo() const;
     bool                        SetModifyPasswordInfo( const 
css::uno::Sequence< css::beans::PropertyValue >& aInfo );
 
diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
index c210c95c1f62..aa728865af10 100644
--- a/include/sfx2/strings.hrc
+++ b/include/sfx2/strings.hrc
@@ -103,6 +103,7 @@
 #define STR_GB                                  NC_("STR_GB", "GB")
 #define STR_QUERY_LASTVERSION                   NC_("STR_QUERY_LASTVERSION", 
"Cancel all changes?")
 #define STR_NO_WEBBROWSER_FOUND                 NC_("STR_NO_WEBBROWSER_FOUND", 
"Opening \"$(ARG1)\" failed with error code $(ARG2) and message: \"$(ARG3)\"
Maybe no web browser could be found on your system. In that case, please check 
your Desktop Preferences or install a web browser (for example, Firefox) in the 
default location requested during the browser installation.")
+#define STR_DANGEROUS_TO_OPEN                   NC_("STR_DANGEROUS_TO_OPEN", 
"It might be dangerous to open \"$(ARG1)\".
Do you really want to open it?")
 #define STR_NO_ABS_URI_REF                      NC_("STR_NO_ABS_URI_REF", 
"\"$(ARG1)\" is not an absolute URL that can be passed to an external 
application to open it.")
 #define STR_GID_INTERN                          NC_("STR_GID_INTERN", 
"Internal")
 #define STR_GID_APPLICATION                     NC_("STR_GID_APPLICATION", 
"Application")
diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
index 33e4ffb13eef..79637466b22e 100644
--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
@@ -27,7 +27,9 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/dispatch.hxx>
 #include <sfx2/objsh.hxx>
+#include <sfx2/sfxresid.hxx>
 #include <sfx2/sfxsids.hrc>
+#include <sfx2/strings.hrc>
 #include <sfx2/viewfrm.hxx>
 #include <sfx2/viewsh.hxx>
 #include <svl/stritem.hxx>
@@ -35,6 +37,8 @@
 #include <svl/zformat.hxx>
 #include <vcl/virdev.hxx>
 #include <vcl/settings.hxx>
+#include <vcl/weld.hxx>
+#include <vcl/window.hxx>
 #include <unotools/charclass.hxx>
 #include <unotools/securityoptions.hxx>
 #include <osl/diagnose.h>
@@ -800,7 +804,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const 
OUString& rTarget)
 
     OUString aUrlName( rURL );
     SfxViewFrame* pFrame = nullptr;
-    const SfxObjectShell* pObjShell = nullptr;
+    SfxObjectShell* pObjShell = nullptr;
     OUString aReferName;
     if ( pScActiveViewShell )
     {
@@ -834,6 +838,35 @@ void ScGlobal::OpenURL(const OUString& rURL, const 
OUString& rTarget)
             aUrlName = aNewUrlName;
     }
 
+    if (INetURLObject(aUrlName).IsExoticProtocol())
+    {
+        // Default to ignoring exotic protocols
+        bool bAllow = false;
+        if (pObjShell)
+        {
+            // If the document had macros when loaded then follow the allowed 
macro-mode
+            if (pObjShell->GetHadCheckedMacrosOnLoad())
+                bAllow = pObjShell->AdjustMacroMode();
+            else // otherwise ask the user, defaulting to cancel
+            {
+                assert(pFrame && "if we have pObjShell we have pFrame");
+                //Reuse URITools::onOpenURI warning string
+                std::unique_ptr<weld::MessageDialog> 
xQueryBox(Application::CreateMessageDialog(pFrame->GetWindow().GetFrameWeld(),
+                                                               
VclMessageType::Warning, VclButtonsType::YesNo,
+                                                               
SfxResId(STR_DANGEROUS_TO_OPEN)));
+                
xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+                    INetURLObject::decode(aUrlName, 
INetURLObject::DecodeMechanism::Unambiguous)));
+                xQueryBox->set_default_response(RET_NO);
+                bAllow = xQueryBox->run() == RET_YES;
+            }
+        }
+        if (!bAllow)
+        {
+            SAL_WARN("sc", "ScGlobal::OpenURL ignoring: " << aUrlName);
+            return;
+        }
+    }
+
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
     if ( nScClickMouseModifier & KEY_SHIFT )     // control-click -> into new 
window
diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
index 3bba9fb09c6c..6d014a38725f 100644
--- a/sfx2/source/doc/docmacromode.cxx
+++ b/sfx2/source/doc/docmacromode.cxx
@@ -388,8 +388,12 @@ namespace sfx2
         return bHasMacros;
     }
 
+    bool DocumentMacroMode::hasMacros() const
+    {
+        return m_xData->m_rDocumentAccess.documentStorageHasMacros() || 
hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading();
+    }
 
-    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< 
XInteractionHandler >& rxInteraction )
+    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< 
XInteractionHandler >& rxInteraction, bool bHasMacros )
     {
         bool bAllow = false;
         if ( SvtSecurityOptions().IsMacroDisabled() )
@@ -399,7 +403,7 @@ namespace sfx2
         }
         else
         {
-            if (m_xData->m_rDocumentAccess.documentStorageHasMacros() || 
hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
+            if (bHasMacros)
             {
                 bAllow = adjustMacroMode( rxInteraction );
             }
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 0d58706cc39b..994f6298074f 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -934,8 +934,15 @@ void SfxObjectShell::CheckSecurityOnLoading_Impl()
 
     // check macro security
     pImpl->aMacroMode.checkMacrosOnLoading( xInteraction );
+    const bool bHasMacros = pImpl->aMacroMode.hasMacros();
+    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasMacros );
+    pImpl->m_bHadCheckedMacrosOnLoad = bHasMacros;
 }
 
+bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
+{
+    return pImpl->m_bHadCheckedMacrosOnLoad;
+}
 
 void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< 
task::XInteractionHandler >& xHandler )
 {
diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx
index 12f2a1ab51f6..5b470320dbb8 100644
--- a/sfx2/source/doc/objxtor.cxx
+++ b/sfx2/source/doc/objxtor.cxx
@@ -235,6 +235,7 @@ SfxObjectShell_Impl::SfxObjectShell_Impl( SfxObjectShell& 
_rDocShell )
     ,m_bAllowShareControlFileClean( true )
     ,m_bConfigOptionsChecked( false )
     ,m_bMacroCallsSeenWhileLoading( false )
+    ,m_bHadCheckedMacrosOnLoad( false )
     ,lErr(ERRCODE_NONE)
     ,nEventId ( SfxEventHintId::NONE )
     ,nLoadedFlags ( SfxLoadedFlags::ALL )
diff --git a/sfx2/source/inc/objshimp.hxx b/sfx2/source/inc/objshimp.hxx
index d52ee83d9a3c..c5b63b5d6d0a 100644
--- a/sfx2/source/inc/objshimp.hxx
+++ b/sfx2/source/inc/objshimp.hxx
@@ -91,7 +91,8 @@ struct SfxObjectShell_Impl : public 
::sfx2::IMacroDocumentAccess
                         m_bSharedXMLFlag:1, // whether the document should be 
edited in shared mode
                         m_bAllowShareControlFileClean:1, // whether the flag 
should be stored in xml file
                         m_bConfigOptionsChecked:1, // whether or not the user 
options are checked after the Options dialog is closed.
-                        m_bMacroCallsSeenWhileLoading:1; // whether or not the 
user options are checked after the Options dialog is closed.
+                        m_bMacroCallsSeenWhileLoading:1, // whether or not 
macro calls were seen when loading document.
+                        m_bHadCheckedMacrosOnLoad:1; // if document contained 
macros (or calls) when loaded
 
     IndexBitSet         aBitSet;
     ErrCode             lErr;
commit a394ab143dad2f6fcca9d3f0aee62b262eb3d1e7
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sat Nov 4 19:57:51 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    warn about exotic protocols as well
    
    Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151834
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 1305f70cff8a81a58a5a6d9c96c5bb032005389e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159034
    Reviewed-by: Eike Rathke <er...@redhat.com>
    (cherry picked from commit 2e1bcbb550d54278b366ec619cc5280d44d6aba4)

diff --git a/sw/source/filter/html/htmlplug.cxx 
b/sw/source/filter/html/htmlplug.cxx
index fb164cd873e1..f4e86c3e26c0 100644
--- a/sw/source/filter/html/htmlplug.cxx
+++ b/sw/source/filter/html/htmlplug.cxx
@@ -1091,7 +1091,7 @@ void SwHTMLParser::InsertFloatingFrame()
 
                 OUString sHRef = aFrameDesc.GetURL().GetMainURL( 
INetURLObject::DecodeMechanism::NONE );
 
-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
                     NotifyMacroEventRead();
 
                 xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
diff --git a/sw/source/filter/xml/xmltexti.cxx 
b/sw/source/filter/xml/xmltexti.cxx
index 0ccb11f233e2..d203f55fea69 100644
--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
@@ -860,7 +860,7 @@ uno::Reference< XPropertySet > 
SwXMLTextImportHelper::createAndInsertFloatingFra
                 OUString sHRef = URIHelper::SmartRel2Abs(
                             INetURLObject( GetXMLImport().GetBaseURL() ), 
rHRef );
 
-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
                     GetXMLImport().NotifyMacroEventRead();
 
                 xSet->setPropertyValue("FrameURL",
diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
index 1e997e82fbf5..00ae62e7cc94 100644
--- a/tools/source/fsys/urlobj.cxx
+++ b/tools/source/fsys/urlobj.cxx
@@ -4958,7 +4958,8 @@ bool INetURLObject::IsExoticProtocol() const
     return m_eScheme == INetProtocol::Slot ||
            m_eScheme == INetProtocol::Macro ||
            m_eScheme == INetProtocol::Uno ||
-           isSchemeEqualTo(u"vnd.sun.star.script");
+           isSchemeEqualTo(u"vnd.sun.star.script") ||
+           isSchemeEqualTo(u"service");
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
index b72ddd8f3554..f2415db0c6d4 100644
--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
@@ -3274,7 +3274,7 @@ void SdXMLFloatingFrameShapeContext::StartElement( const 
css::uno::Reference< cs
 
             if( !maHref.isEmpty() )
             {
-                if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(maHref).IsExoticProtocol())
                     GetImport().NotifyMacroEventRead();
 
                 xProps->setPropertyValue("FrameURL", Any(maHref) );
commit 902f5266b950cad99b54357e9c586e1be33bfdf7
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Fri Nov 3 17:14:26 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    add some protocols that don't make sense as floating frame targets
    
    Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)

diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx
index 3cbbab49f5bf..33ed835c868e 100644
--- a/include/tools/urlobj.hxx
+++ b/include/tools/urlobj.hxx
@@ -946,6 +946,11 @@ public:
 
     void changeScheme(INetProtocol eTargetScheme);
 
+    // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot,
+    // vnd.sun.star.script, etc. All the types of URLs which shouldn't
+    // be accepted from an outside controlled source
+    bool IsExoticProtocol() const;
+
 private:
     // General Structure:
 
diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
index 12ea3b104a20..f40c535154d7 100644
--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
@@ -168,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load(
         xTrans->parseStrict( aTargetURL );
 
         INetURLObject aURLObject(aTargetURL.Complete);
-        if (aURLObject.GetProtocol() == INetProtocol::Macro || 
aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
+        if (aURLObject.IsExoticProtocol())
+        {
+            SAL_WARN("sfx", "IFrameObject::load ignoring: " << 
aTargetURL.Complete);
             return false;
+        }
 
         uno::Reference<frame::XFramesSupplier> xParentFrame = 
xFrame->getCreator();
         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
index 84627e501e1d..1e997e82fbf5 100644
--- a/tools/source/fsys/urlobj.cxx
+++ b/tools/source/fsys/urlobj.cxx
@@ -4953,4 +4953,12 @@ OUString INetURLObject::CutExtension()
         ? aTheExtension : OUString();
 }
 
+bool INetURLObject::IsExoticProtocol() const
+{
+    return m_eScheme == INetProtocol::Slot ||
+           m_eScheme == INetProtocol::Macro ||
+           m_eScheme == INetProtocol::Uno ||
+           isSchemeEqualTo(u"vnd.sun.star.script");
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
commit 8dc24a0dd9eb735519c2e769429fb36f2ced447f
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Fri Nov 3 14:20:07 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:58 2024 +0200

    escape url passed to gstreamer
    
    Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)

diff --git a/avmedia/source/gstreamer/gstframegrabber.cxx 
b/avmedia/source/gstreamer/gstframegrabber.cxx
index def1018baeed..d559ac28239e 100644
--- a/avmedia/source/gstreamer/gstframegrabber.cxx
+++ b/avmedia/source/gstreamer/gstframegrabber.cxx
@@ -64,7 +64,7 @@ FrameGrabber::FrameGrabber( const OUString &rURL ) :
         "bpp=(int)24,depth=(int)24,endianness=(int)4321,"
         "red_mask=(int)0xff0000, green_mask=(int)0x00ff00, 
blue_mask=(int)0x0000ff\"",
 #else
-        "uridecodebin uri=%s ! videoconvert ! videoscale ! appsink "
+        "uridecodebin name=source ! videoconvert ! videoscale ! appsink "
         "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"",
 #endif
         OUStringToOString( rURL, RTL_TEXTENCODING_UTF8 ).getStr() );
@@ -78,6 +78,12 @@ FrameGrabber::FrameGrabber( const OUString &rURL ) :
     }
 
     if( mpPipeline ) {
+
+        if (GstElement *pUriDecode = gst_bin_get_by_name(GST_BIN(mpPipeline), 
"source"))
+            g_object_set(pUriDecode, "uri", OUStringToOString(rURL, 
RTL_TEXTENCODING_UTF8).getStr(), nullptr);
+        else
+            g_warning("Missing 'source' element in gstreamer pipeline");
+
         // pre-roll
         switch( gst_element_set_state( mpPipeline, GST_STATE_PAUSED ) ) {
         case GST_STATE_CHANGE_FAILURE:
commit 6d838aa1306c219936d5c03adda1604918addf3e
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Oct 16 15:21:03 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri May 17 18:29:57 2024 +0200

    check earlier on loading ole objects if parent doc is untrusted referer
    
    Conflicts:
            embeddedobj/source/commonembedding/persistence.cxx
    
    Change-Id: Ib1169d5c40ca87f789c71b48124754e073895fcd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158054
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 7273de2730022deb37a8c7f2fedbe7fc4551f9b5)

diff --git a/embeddedobj/source/commonembedding/persistence.cxx 
b/embeddedobj/source/commonembedding/persistence.cxx
index 17fb058ebaa5..8f76c4c4cb29 100644
--- a/embeddedobj/source/commonembedding/persistence.cxx
+++ b/embeddedobj/source/commonembedding/persistence.cxx
@@ -53,10 +53,11 @@
 #include <comphelper/storagehelper.hxx>
 #include <comphelper/mimeconfighelper.hxx>
 #include <comphelper/namedvaluecollection.hxx>
+#include <unotools/configmgr.hxx>
+#include <unotools/securityoptions.hxx>
 
 #include <tools/diagnose_ex.h>
 #include <sal/log.hxx>
-#include <unotools/configmgr.hxx>
 #include "persistence.hxx"
 
 using namespace ::com::sun::star;
@@ -366,20 +367,15 @@ uno::Reference< util::XCloseable > 
OCommonEmbeddedObject::InitNewDocument_Impl()
     return xDocument;
 }
 
-
 uno::Reference< util::XCloseable > OCommonEmbeddedObject::LoadLink_Impl()
 {
-    uno::Reference< util::XCloseable > xDocument( CreateDocument( m_xContext, 
GetDocumentServiceName(),
-                                                m_bEmbeddedScriptSupport, 
m_bDocumentRecoverySupport ) );
-
-    uno::Reference< frame::XLoadable > xLoadable( xDocument, 
uno::UNO_QUERY_THROW );
-
     sal_Int32 nLen = 2;
-e 
... etc. - the rest is truncated

Reply via email to