Merge branch '4.13'

cura_app.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright (c) 2020 Ultimaker B.V.
+# Copyright (c) 2022 Ultimaker B.V.
 # Cura is released under the terms of the LGPLv3 or higher.
 
 # Remove the working directory from sys.path.
@@ -15,6 +15,9 @@ if "" in sys.path:
 import argparse
 import faulthandler
 import os
+if sys.platform != "linux":  # Turns out the Linux build _does_ use this, but we're not making an Enterprise release for that system anyway.
+    os.environ["QT_PLUGIN_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
+    os.environ["QML2_IMPORT_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
 
 from PyQt5.QtNetwork import QSslConfiguration, QSslSocket
 

resources/texts/change_log.txt

@@ -1,4 +1,4 @@
-[4.13]
+[4.13.0]
 <i>For an overview of the new features in Cura 4.13, please watch <a href="https://youtu.be/chvAuI6Eqto">our video</a>.</i>
 
 * Sync material profiles 
@@ -56,6 +56,7 @@ We’ve streamlined the user login authentication by removing any restrictions,
 - Fixed a bug where support blockers were included in the bounding box after loading a project file
 - Fixed a bug where grouped models become unslicable if the first extruder was disabled
 - Fixed a bug in Tree Support where the Z Distance was too big
+- Prevented QT plug-ins from being loaded from an insecure directory if an environment variable is set
 
 * Printer definitions, profiles and materials:
 - Add Eazao Zero printer definition, contributed by Hogan-Polaris