Security fix by trolltech

6 files changed, 392 insertions, 281 deletions

diff --git a/core/launcher/desktop.cpp b/core/launcher/desktop.cpp
index 24dce73..541b4be 100644
--- a/core/launcher/desktop.cpp
+++ b/core/launcher/desktop.cpp
@@ -568,4 +568,4 @@ void Desktop::execAutoStart() {
         e << QString(appName);
-    } else {
-    }
+    } //else {
+    //}
 }
diff --git a/core/launcher/launcher.pro b/core/launcher/launcher.pro
index ccf8231..169edc1 100644
--- a/core/launcher/launcher.pro
+++ b/core/launcher/launcher.pro
@@ -101,3 +101,3 @@ DEPENDPATH	+= $(OPIEDIR)/rsync
 TARGET		= qpe
-LIBS		+= -lqpe -lcrypt -lopie
+LIBS		+= -lqpe -lcrypt -lopie -luuid
 
diff --git a/core/launcher/qcopbridge.cpp b/core/launcher/qcopbridge.cpp
index 2d084fc..85993ee 100644
--- a/core/launcher/qcopbridge.cpp
+++ b/core/launcher/qcopbridge.cpp
@@ -1,5 +1,5 @@
 /**********************************************************************
-** Copyright (C) 2000 Trolltech AS.  All rights reserved.
+** Copyright (C) 2000-2002 Trolltech AS.  All rights reserved.
 **
-** This file is part of Qtopia Environment.
+** This file is part of the Qtopia Environment.
 **
@@ -23,4 +23,7 @@
 
+#ifdef QWS
 #include <qpe/qcopenvelope_qws.h>
+#endif
 #include <qpe/qpeapplication.h>
+#include <qpe/version.h>
 
@@ -33,9 +36,7 @@
 #include <qregexp.h>
+#ifdef QWS
 #include <qcopchannel_qws.h>
+#endif
 
-// actually this is wrong, _XOPEN_SOURCE should get defined on the commandline
-// and it should have a proper value assigned. (Simon)
-#if !defined(_XOPEN_SOURCE)
 #define _XOPEN_SOURCE
-#endif
 #include <pwd.h>
@@ -52,3 +53,3 @@ const int block_size = 51200;
 
-QCopBridge::QCopBridge( Q_UINT16 port, QObject *parent,
+QCopBridge::QCopBridge( Q_UINT16 port, QObject *parent ,
         const char* name )
@@ -59,10 +60,12 @@ QCopBridge::QCopBridge( Q_UINT16 port, QObject *parent,
     if ( !ok() )
-  qWarning( "Failed to bind to port %d", port );
+	qWarning( "Failed to bind to port %d", port );
     else {
-  desktopChannel = new QCopChannel( "QPE/Desktop", this );
-  connect( desktopChannel, SIGNAL(received(const QCString &, const QByteArray &)),
-     this, SLOT(desktopMessage( const QCString &, const QByteArray &)) );
-  cardChannel = new QCopChannel( "QPE/Card", this );
-  connect( cardChannel, SIGNAL(received(const QCString &, const QByteArray &)),
-     this, SLOT(desktopMessage( const QCString &, const QByteArray &)) );
+#ifndef QT_NO_COP
+	desktopChannel = new QCopChannel( "QPE/Desktop", this );
+	connect( desktopChannel, SIGNAL(received(const QCString &, const QByteArray &)),
+		 this, SLOT(desktopMessage( const QCString &, const QByteArray &)) );
+	cardChannel = new QCopChannel( "QPE/Card", this );
+	connect( cardChannel, SIGNAL(received(const QCString &, const QByteArray &)),
+		 this, SLOT(desktopMessage( const QCString &, const QByteArray &)) );
+#endif
     }
@@ -73,3 +76,5 @@ QCopBridge::~QCopBridge()
 {
+#ifndef QT_NO_COP
     delete desktopChannel;
+#endif
 }
@@ -81,7 +86,9 @@ void QCopBridge::newConnection( int socket )
     connect ( pi, SIGNAL( connectionClosed( QCopBridgePI *) ), this, SLOT( connectionClosed( QCopBridgePI *) ) );
+#ifndef QT_NO_COP
     QCopEnvelope( "QPE/System", "setScreenSaverMode(int)" ) << QPEApplication::DisableSuspend;
-    
+#endif
+
     if ( sendSync ) {
-  pi ->startSync();
-  sendSync = FALSE;
+	pi ->startSync();
+	sendSync = FALSE;
     }
@@ -93,5 +100,7 @@ void QCopBridge::connectionClosed( QCopBridgePI *pi )
     if ( openConnections.count() == 0 ) {
-  QCopEnvelope( "QPE/System", "setScreenSaverMode(int)" ) << QPEApplication::Enable;
+#ifndef QT_NO_COP
+	QCopEnvelope( "QPE/System", "setScreenSaverMode(int)" ) << QPEApplication::Enable;
+#endif
     }
-}    
+}
 
@@ -101,3 +110,3 @@ void QCopBridge::closeOpenConnections()
     for ( pi = openConnections.first(); pi != 0; pi = openConnections.next() )
-  pi->close();
+	pi->close();
 }
@@ -111,4 +120,4 @@ void QCopBridge::desktopMessage( const QCString &command, const QByteArray &args
     if ( paren <= 0 ) {
-  qDebug("DesktopMessage: bad qcop syntax");
-  return;
+	qDebug("DesktopMessage: bad qcop syntax");
+	return;
     }
@@ -117,4 +126,4 @@ void QCopBridge::desktopMessage( const QCString &command, const QByteArray &args
     if ( params[params.length()-1] != ')' ) {
-  qDebug("DesktopMessage: bad qcop syntax");
-  return;
+	qDebug("DesktopMessage: bad qcop syntax");
+	return;
     }
@@ -126,29 +135,47 @@ void QCopBridge::desktopMessage( const QCString &command, const QByteArray &args
     if ( paramList.count() ) {
-  QDataStream stream( args, IO_ReadOnly );
-  for ( QStringList::Iterator it = paramList.begin(); it != paramList.end(); ++it ) {
-      QString str;
-      if ( *it == "QString" ) {
-    stream >> str;
-      } else if ( *it == "QCString" ) {
-    QCString cstr;
-    stream >> cstr;
-    str = QString::fromLocal8Bit( cstr );
-      } else if ( *it == "int" ) {
-    int i;
-    stream >> i;
-    str = QString::number( i );
-      } else if ( *it == "bool" ) {
-    int i;
-    stream >> i;
-    str = QString::number( i );
-      } else {
-    qDebug(" cannot route the argument type %s through the qcop bridge", (*it).latin1() );
-    return;
-      }
-      str.replace( QRegExp("&"), "&amp;" );
-      str.replace( QRegExp(" "), "&0x20;" );
-      str.replace( QRegExp("\n"), "&0x0d;" );
-      str.replace( QRegExp("\r"), "&0x0a;" );
-      data += " " + str;
-  }
+	QDataStream stream( args, IO_ReadOnly );
+	for ( QStringList::Iterator it = paramList.begin(); it != paramList.end(); ++it ) {
+	    QString str;
+	    if ( *it == "QString" ) {
+		stream >> str;
+	    } else if ( *it == "QCString" ) {
+		QCString cstr;
+		stream >> cstr;
+		str = QString::fromLocal8Bit( cstr );
+	    } else if ( *it == "int" ) {
+		int i;
+		stream >> i;
+		str = QString::number( i );
+	    } else if ( *it == "bool" ) {
+		int i;
+		stream >> i;
+		str = QString::number( i );
+	    } else {
+		qDebug(" cannot route the argument type %s throught the qcop bridge", (*it).latin1() );
+		return;
+	    }
+	    QString estr;
+	    for (int i=0; i<(int)str.length(); i++) {
+		QChar ch = str[i];
+		if ( ch.row() )
+		    goto quick;
+		switch (ch.cell()) {
+		    case '&':
+			estr.append( "&amp;" );
+			break;
+		    case ' ':
+			estr.append( "&0x20;" );
+			break;
+		    case '\n':
+			estr.append( "&0x0d;" );
+			break;
+		    case '\r':
+			estr.append( "&0x0a;" );
+			break;
+		    default: quick:
+			estr.append(ch);
+		}
+	    }
+	    data += " " + estr;
+	}
     }
@@ -157,10 +184,10 @@ void QCopBridge::desktopMessage( const QCString &command, const QByteArray &args
     if ( command == "startSync()" ) {
-  // we need to buffer it a bit
-  sendSync = TRUE;
-  startTimer( 20000 );
-    }  
-    
+	// we need to buffer it a bit
+	sendSync = TRUE;
+	startTimer( 20000 );
+    }
+
     QCopBridgePI *pi;
     for ( pi = openConnections.first(); pi != 0; pi = openConnections.next() ) {
-  pi->sendDesktopMessage( sendCommand );
+	pi->sendDesktopMessage( sendCommand );
     }
@@ -175,4 +202,4 @@ void QCopBridge::timerEvent( QTimerEvent * )
 
-QCopBridgePI::QCopBridgePI( int socket, QObject *parent, const char* name )
-    : QSocket( parent, name ) 
+QCopBridgePI::QCopBridgePI( int socket, QObject *parent , const char* name )
+    : QSocket( parent, name )
 {
@@ -184,19 +211,24 @@ QCopBridgePI::QCopBridgePI( int socket, QObject *parent, const char* name )
 #ifndef INSECURE
-    if ( !accessAuthorized(peeraddress) ) {
-  state = Forbidden;
-  startTimer( 0 );
-    } else 
-#endif  
+    if ( !SyncAuthentication::isAuthorized(peeraddress) ) {
+	state = Forbidden;
+	startTimer( 0 );
+    } else
+#endif	
     {
-  state = Connected;
-  sendSync = FALSE;
-  connect( this, SIGNAL( readyRead() ), SLOT( read() ) );
-  connect( this, SIGNAL( connectionClosed() ), SLOT( connectionClosed() ) );
-
-  send( "220 Qtopia QCop bridge ready!" );
-  state = Wait_USER;
-
-  // idle timer to close connections when not used anymore
-  startTimer( 60000 );
-  connected = TRUE;
+	state = Connected;
+	sendSync = FALSE;
+	connect( this, SIGNAL( readyRead() ), SLOT( read() ) );
+	connect( this, SIGNAL( connectionClosed() ), SLOT( connectionClosed() ) );
+
+	QString intro="220 Qtopia ";
+	intro += QPE_VERSION; intro += ";";
+	intro += "challenge="; intro += SyncAuthentication::serverId(); intro += ";";
+	intro += "loginname="; intro += SyncAuthentication::loginName(); intro += ";";
+	intro += "displayname="; intro += SyncAuthentication::ownerName(); intro += ";";
+	send( intro );
+	state = Wait_USER;
+
+	// idle timer to close connections when not used anymore
+	startTimer( 60000 );
+	connected = TRUE;
     }
@@ -234,34 +266,3 @@ void QCopBridgePI::read()
     while ( canReadLine() )
-  process( readLine().stripWhiteSpace() );
-}
-
-bool QCopBridgePI::checkUser( const QString& user )
-{
-    if ( user.isEmpty() ) return FALSE;
-
-    struct passwd *pw;
-    pw = getpwuid( geteuid() );
-    QString euser = QString::fromLocal8Bit( pw->pw_name );
-    return user == euser;
-}
-
-bool QCopBridgePI::checkPassword( const QString& password )
-{
-    // ### HACK for testing on local host
-    return true;
-
-    /*
-    struct passwd *pw = 0;
-    struct spwd *spw = 0;
-
-    pw = getpwuid( geteuid() );
-    spw = getspnam( pw->pw_name );
-
-    QString cpwd = QString::fromLocal8Bit( pw->pw_passwd );
-    if ( cpwd == "x" && spw )
-  cpwd = QString::fromLocal8Bit( spw->sp_pwdp );
-
-    QString cpassword = QString::fromLocal8Bit( crypt( password.local8Bit(), cpwd.local8Bit() ) );
-    return cpwd == cpassword;
-*/
+	process( readLine().stripWhiteSpace() );
 }
@@ -282,9 +283,9 @@ void QCopBridgePI::process( const QString& message )
     if ( msg.count() >= 2 )
-  arg = msg[1];
-    
+	arg = msg[1];
+
     // we always respond to QUIT, regardless of state
     if ( cmd == "QUIT" ) {
-  send( "211 Have a nice day!" );
-  delete this;
-  return;
+	send( "211 Have a nice day!" );
+	delete this;
+	return;
     }
@@ -293,3 +294,3 @@ void QCopBridgePI::process( const QString& message )
     if ( Connected == state )
-  return;
+	return;
 
@@ -298,9 +299,9 @@ void QCopBridgePI::process( const QString& message )
 
-  if ( cmd != "USER" || msg.count() < 2 || !checkUser( arg ) ) {
-      send( "530 Please login with USER and PASS" );
-      return;
-  }
-  send( "331 User name ok, need password" );
-  state = Wait_PASS;
-  return;
+	if ( cmd != "USER" || msg.count() < 2 || !SyncAuthentication::checkUser( arg ) ) {
+	    send( "530 Please login with USER and PASS" );
+	    return;
+	}
+	send( "331 User name ok, need password" );
+	state = Wait_PASS;
+	return;
     }
@@ -310,14 +311,13 @@ void QCopBridgePI::process( const QString& message )
 
-  if ( cmd != "PASS" || !checkPassword( arg ) ) {
-  //if ( cmd != "PASS" || msg.count() < 2 || !checkPassword( arg ) ) {
-      send( "530 Please login with USER and PASS" );
-      return;
-  }
-  send( "230 User logged in, proceed" );
-  state = Ready;
-  if ( sendSync ) {
-      sendDesktopMessage( "startSync()" );
-      sendSync = FALSE;
-  }
-  return;
+	if ( cmd != "PASS" || !SyncAuthentication::checkPassword( arg ) ) {
+	    send( "530 Please login with USER and PASS" );
+	    return;
+	}
+	send( "230 User logged in, proceed" );
+	state = Ready;
+	if ( sendSync ) {
+	    sendDesktopMessage( "startSync()" );
+	    sendSync = FALSE;
+	}
+	return;
     }
@@ -326,6 +326,6 @@ void QCopBridgePI::process( const QString& message )
     else if ( cmd == "NOOP" ) {
-  connected = TRUE;
-  send( "200 Command okay" );
+	connected = TRUE;
+	send( "200 Command okay" );
     }
-    
+
     // call (CALL)
@@ -333,74 +333,78 @@ void QCopBridgePI::process( const QString& message )
 
-  // example: call QPE/System execute(QString) addressbook
-
-  if ( msg.count() < 3 ) {
-      send( "500 Syntax error, command unrecognized" );
-  }
-  else {
-
-      QString channel = msg[1];
-      QString command = msg[2];
-
-      command.stripWhiteSpace();
-
-      int paren = command.find( "(" );
-      if ( paren <= 0 ) {
-    send( "500 Syntax error, command unrecognized" );
-    return;
-      }
-
-      QString params = command.mid( paren + 1 );
-      if ( params[params.length()-1] != ')' ) {
-    send( "500 Syntax error, command unrecognized" );
-    return;
-      }
-
-      params.truncate( params.length()-1 );
-      QByteArray buffer;
-      QDataStream ds( buffer, IO_WriteOnly );
-
-      int msgId = 3;
-
-      QStringList paramList = QStringList::split( ",", params );
-      if ( paramList.count() > msg.count() - 3 ) {
-    send( "500 Syntax error, command unrecognized" );
-    return;
-      }
-
-      for ( QStringList::Iterator it = paramList.begin(); it != paramList.end(); ++it ) {
-
-    QString arg = msg[msgId];
-    arg.replace( QRegExp("&0x20;"), " " );
-    arg.replace( QRegExp("&amp;"), "&" );
-    arg.replace( QRegExp("&0x0d;"), "\n" );
-    arg.replace( QRegExp("&0x0a;"), "\r" );
-    if ( *it == "QString" )
-        ds << arg;
-    else if ( *it == "QCString" )
-        ds << arg.local8Bit();
-    else if ( *it == "int" )
-        ds << arg.toInt();
-    else if ( *it == "bool" )
-        ds << arg.toInt();
-    else {
-        send( "500 Syntax error, command unrecognized" );
-        return;
-    }
-    msgId++;
-      }
-
-      if ( !QCopChannel::isRegistered( channel.latin1() ) ) {
-    // send message back about it
-    QString answer = "599 ChannelNotRegistered " + channel;
-    send( answer );
-    return;
-      }
-      
-      if ( paramList.count() )
-    QCopChannel::send( channel.latin1(), command.latin1(), buffer );
-      else
-    QCopChannel::send( channel.latin1(), command.latin1() );
-
-      send( "200 Command okay" );
-  }
+	// example: call QPE/System execute(QString) addressbook
+
+	if ( msg.count() < 3 ) {
+	    send( "500 Syntax error, command unrecognized" );
+	}
+	else {
+
+	    QString channel = msg[1];
+	    QString command = msg[2];
+
+	    command.stripWhiteSpace();
+
+	    int paren = command.find( "(" );
+	    if ( paren <= 0 ) {
+		send( "500 Syntax error, command unrecognized" );
+		return;
+	    }
+
+	    QString params = command.mid( paren + 1 );
+	    if ( params[params.length()-1] != ')' ) {
+		send( "500 Syntax error, command unrecognized" );
+		return;
+	    }
+
+	    params.truncate( params.length()-1 );
+	    QByteArray buffer;
+	    QDataStream ds( buffer, IO_WriteOnly );
+
+	    int msgId = 3;
+
+	    QStringList paramList = QStringList::split( ",", params );
+	    if ( paramList.count() > msg.count() - 3 ) {
+		send( "500 Syntax error, command unrecognized" );
+		return;
+	    }
+
+	    for ( QStringList::Iterator it = paramList.begin(); it != paramList.end(); ++it ) {
+
+		QString arg = msg[msgId];
+		arg.replace( QRegExp("&0x20;"), " " );
+		arg.replace( QRegExp("&amp;"), "&" );
+		arg.replace( QRegExp("&0x0d;"), "\n" );
+		arg.replace( QRegExp("&0x0a;"), "\r" );
+		if ( *it == "QString" )
+		    ds << arg;
+		else if ( *it == "QCString" )
+		    ds << arg.local8Bit();
+		else if ( *it == "int" )
+		    ds << arg.toInt();
+		else if ( *it == "bool" )
+		    ds << arg.toInt();
+		else {
+		    send( "500 Syntax error, command unrecognized" );
+		    return;
+		}
+		msgId++;
+	    }
+
+#ifndef QT_NO_COP
+	    if ( !QCopChannel::isRegistered( channel.latin1() ) ) {
+		// send message back about it
+		QString answer = "599 ChannelNotRegistered " + channel;
+		send( answer );
+		return;
+	    }
+#endif
+	
+#ifndef QT_NO_COP
+	    if ( paramList.count() )
+		QCopChannel::send( channel.latin1(), command.latin1(), buffer );
+	    else
+		QCopChannel::send( channel.latin1(), command.latin1() );
+
+	    send( "200 Command okay" );
+#endif
+	}
     }
@@ -408,3 +412,3 @@ void QCopBridgePI::process( const QString& message )
     else
-  send( "502 Command not implemented" );
+	send( "502 Command not implemented" );
 }
@@ -416,5 +420,5 @@ void QCopBridgePI::timerEvent( QTimerEvent * )
     if ( connected )
-  connected = FALSE;
+	connected = FALSE;
     else
-  connectionClosed();
+	connectionClosed();
 }
diff --git a/core/launcher/qcopbridge.h b/core/launcher/qcopbridge.h
index 114b3ee..408d10d 100644
--- a/core/launcher/qcopbridge.h
+++ b/core/launcher/qcopbridge.h
@@ -1,5 +1,5 @@
 /**********************************************************************
-** Copyright (C) 2000 Trolltech AS.  All rights reserved.
+** Copyright (C) 2000-2002 Trolltech AS.  All rights reserved.
 **
-** This file is part of Qtopia Environment.
+** This file is part of the Qtopia Environment.
 **
@@ -81,5 +81,2 @@ protected slots:
 protected:
-    bool checkUser( const QString& user );
-    bool checkPassword( const QString& pw );
-
     void timerEvent( QTimerEvent *e );
diff --git a/core/launcher/transferserver.cpp b/core/launcher/transferserver.cpp
index 7294f9c..a6dab07 100644
--- a/core/launcher/transferserver.cpp
+++ b/core/launcher/transferserver.cpp
@@ -1,5 +1,5 @@
 /**********************************************************************
-** Copyright (C) 2000 Trolltech AS.  All rights reserved.
+** Copyright (C) 2000-2002 Trolltech AS.  All rights reserved.
 **
-** This file is part of Qtopia Environment.
+** This file is part of the Qtopia Environment.
 **
@@ -24,2 +24,9 @@
 #include <stdlib.h>
+#include <time.h>
+#include <shadow.h>
+
+extern "C" {
+#include <uuid/uuid.h>
+#define UUID_H_INCLUDED
+}
 
@@ -39,4 +46,10 @@
 #include <qpe/process.h>
+#include <qpe/global.h>
 #include <qpe/config.h>
+#include <qpe/contact.h>
+#include <qpe/quuid.h>
+#include <qpe/version.h>
+#ifdef QWS
 #include <qpe/qcopenvelope_qws.h>
+#endif
 
@@ -47,3 +60,3 @@ const int block_size = 51200;
 
-TransferServer::TransferServer( Q_UINT16 port, QObject *parent,
+TransferServer::TransferServer( Q_UINT16 port, QObject *parent ,
         const char* name )
@@ -65,3 +78,3 @@ void TransferServer::newConnection( int socket )
 
-bool accessAuthorized(QHostAddress peeraddress)
+QString SyncAuthentication::serverId()
 {
@@ -69,17 +82,123 @@ bool accessAuthorized(QHostAddress peeraddress)
     cfg.setGroup("Sync");
-    uint auth_peer = cfg.readNumEntry("auth_peer",0xc0a80100);
+    QString r=cfg.readEntry("serverid");
+    if ( r.isEmpty() ) {
+	uuid_t uuid;
+	uuid_generate( uuid );
+	cfg.writeEntry("serverid",(r = QUuid( uuid ).toString()));
+    }
+    return r;
+}
+
+QString SyncAuthentication::ownerName()
+{
+    QString vfilename = Global::applicationFileName("addressbook",
+                "businesscard.vcf");
+    if (QFile::exists(vfilename)) {
+	Contact c;
+	c = Contact::readVCard( vfilename )[0];
+	return c.fullName();
+    }
+
+    return "";
+}
+
+QString SyncAuthentication::loginName()
+{
+    struct passwd *pw;
+    pw = getpwuid( geteuid() );
+    return QString::fromLocal8Bit( pw->pw_name );
+}
+
+int SyncAuthentication::isAuthorized(QHostAddress peeraddress)
+{
+    Config cfg("Security");
+    cfg.setGroup("Sync");
+    QString allowedstr = cfg.readEntry("auth_peer","192.168.1.0");
+    QHostAddress allowed;
+    allowed.setAddress(allowedstr);
+    uint auth_peer = allowed.ip4Addr();
     uint auth_peer_bits = cfg.readNumEntry("auth_peer_bits",24);
-    bool ok = (peeraddress.ip4Addr() & (((1<<auth_peer_bits)-1)<<(32-auth_peer_bits)))
-		    == auth_peer;
-    /* Allows denial-of-service attack.
-    if ( !ok ) {
-	QMessageBox::warning(0,tr("Security"),
-	    tr("<p>An attempt to access this device from %1 has been denied.")
-		.arg(peeraddress.toString()));
-    }
-    */
-    return ok;
+    uint mask = auth_peer_bits >= 32 // shifting by 32 is not defined
+	? 0xffffffff : (((1<<auth_peer_bits)-1)<<(32-auth_peer_bits));
+    return (peeraddress.ip4Addr() & mask) == auth_peer;
+}
+
+bool SyncAuthentication::checkUser( const QString& user )
+{
+    if ( user.isEmpty() ) return FALSE;
+    QString euser = loginName();
+    return user == euser;
 }
 
-ServerPI::ServerPI( int socket, QObject *parent, const char* name )
+bool SyncAuthentication::checkPassword( const QString& password )
+{
+#ifdef ALLOW_UNIX_USER_FTP
+    // First, check system password...
+
+    struct passwd *pw = 0;
+    struct spwd *spw = 0;
+
+    pw = getpwuid( geteuid() );
+    spw = getspnam( pw->pw_name );
+
+    QString cpwd = QString::fromLocal8Bit( pw->pw_passwd );
+    if ( cpwd == "x" && spw )
+	cpwd = QString::fromLocal8Bit( spw->sp_pwdp );
+
+    // Note: some systems use more than crypt for passwords.
+    QString cpassword = QString::fromLocal8Bit( crypt( password.local8Bit(), cpwd.local8Bit() ) );
+    if ( cpwd == cpassword )
+	return TRUE;
+#endif
+
+    static int lastdenial=0;
+    static int denials=0;
+    int now = time(0);
+
+    // Detect old Qtopia Desktop (no password)
+    if ( password.isEmpty() ) {
+	if ( denials < 1 || now > lastdenial+600 ) {
+	    QMessageBox::warning( 0,tr("Sync Connection"),
+		tr("<p>An unauthorized system is requesting access to this device."
+		    "<p>If you are using a version of Qtopia Desktop older than 1.5.1, "
+		    "please upgrade."),
+		tr("Deny") );
+	    denials++;
+	    lastdenial=now;
+	}
+	return FALSE;
+    }
+
+    // Second, check sync password...
+    if ( password.left(6) == "Qtopia" ) {
+	QString cpassword = QString::fromLocal8Bit( crypt( password.mid(8).local8Bit(), "qp" ) );
+	Config cfg("Security");
+	cfg.setGroup("Sync");
+	QString pwds = cfg.readEntry("Passwords");
+	if ( QStringList::split(QChar(' '),pwds).contains(cpassword) )
+	    return TRUE;
+
+	// Unrecognized system. Be careful...
+
+	if ( (denials > 2 && now < lastdenial+600)
+	    || QMessageBox::warning(0,tr("Sync Connection"),
+		tr("<p>An unrecognized system is requesting access to this device."
+		    "<p>If you have just initiated a Sync for the first time, this is normal."),
+		tr("Allow"),tr("Deny"))==1 )
+	{
+	    denials++;
+	    lastdenial=now;
+	    return FALSE;
+	} else {
+	    denials=0;
+	    cfg.writeEntry("Passwords",pwds+" "+cpassword);
+	    return TRUE;
+	}
+    }
+
+    return FALSE;
+}
+
+
+ServerPI::ServerPI( int socket, QObject *parent , const char* name  )
     : QSocket( parent, name ) , dtp( 0 ), serversocket( 0 ), waitsocket( 0 )
@@ -94,3 +213,3 @@ ServerPI::ServerPI( int socket, QObject *parent, const char* name )
 #ifndef INSECURE
-    if ( !accessAuthorized(peeraddress) ) {
+    if ( !SyncAuthentication::isAuthorized(peeraddress) ) {
 	state = Forbidden;
@@ -107,3 +226,3 @@ ServerPI::ServerPI( int socket, QObject *parent, const char* name )
 
-	send( "220 Qtopia transfer service ready!" );
+	send( "220 Qtopia " QPE_VERSION " FTP Server" );
 	state = Wait_USER;
@@ -153,33 +272,2 @@ void ServerPI::read()
 
-bool ServerPI::checkUser( const QString& user )
-{
-    if ( user.isEmpty() ) return FALSE;
-
-    struct passwd *pw;
-    pw = getpwuid( geteuid() );
-    QString euser = QString::fromLocal8Bit( pw->pw_name );
-    return user == euser;
-}
-
-bool ServerPI::checkPassword( const QString& /* password */ )
-{
-    // ### HACK for testing on local host
-    return true;
-
-    /*
-    struct passwd *pw = 0;
-    struct spwd *spw = 0;
-
-    pw = getpwuid( geteuid() );
-    spw = getspnam( pw->pw_name );
-
-    QString cpwd = QString::fromLocal8Bit( pw->pw_passwd );
-    if ( cpwd == "x" && spw )
-	cpwd = QString::fromLocal8Bit( spw->sp_pwdp );
-
-    QString cpassword = QString::fromLocal8Bit( crypt( password.local8Bit(), cpwd.local8Bit() ) );
-    return cpwd == cpassword;
-*/
-}
-
 bool ServerPI::checkReadFile( const QString& file )
@@ -256,3 +344,3 @@ void ServerPI::process( const QString& message )
 
-	if ( cmd != "USER" || msg.count() < 2 || !checkUser( arg ) ) {
+	if ( cmd != "USER" || msg.count() < 2 || !SyncAuthentication::checkUser( arg ) ) {
 	    send( "530 Please login with USER and PASS" );
@@ -268,4 +356,3 @@ void ServerPI::process( const QString& message )
 
-	if ( cmd != "PASS" || !checkPassword( arg ) ) {
-	//if ( cmd != "PASS" || msg.count() < 2 || !checkPassword( arg ) ) {
+	if ( cmd != "PASS" || !SyncAuthentication::checkPassword( arg ) ) {
 	    send( "530 Please login with USER and PASS" );
@@ -456,6 +543,9 @@ void ServerPI::process( const QString& message )
 	    QFile file( absFilePath( args ) ) ;
-	    if ( file.remove() )
+	    if ( file.remove() ) {
 		send( "250 Requested file action okay, completed" );
-	    else
+		QCopEnvelope e("QPE/System", "linkChanged(QString)" );
+		e << file.name();
+	    } else {
 		send( "550 Requested action not taken" );
+	    }
 	}
@@ -636,5 +726,12 @@ void ServerPI::dtpCompleted()
 {
-    dtp->close();
-    waitsocket = 0;
     send( "226 Closing data connection, file transfer successful" );
+    if ( dtp->dtpMode() == ServerDTP::RetrieveFile ) {
+	QString fn = dtp->fileName();
+	if ( fn.right(8)==".desktop" && fn.find("/Documents/")>=0 ) {
+	    QCopEnvelope e("QPE/System", "linkChanged(QString)" );
+	    e << fn;
+	}
+    }
+    waitsocket = 0;
+    dtp->close();
 }
@@ -854,3 +951,3 @@ void ServerPI::timerEvent( QTimerEvent * )
 
-ServerDTP::ServerDTP( QObject *parent, const char* name )
+ServerDTP::ServerDTP( QObject *parent = 0, const char* name = 0)
   : QSocket( parent, name ), mode( Idle ), createTargzProc( 0 ),
@@ -893,4 +990,6 @@ void ServerDTP::extractTarDone()
     qDebug("extract done");
+#ifndef QT_NO_COP
     QCopEnvelope e( "QPE/Desktop", "restoreDone(QString)" );
     e << file.name();
+#endif
 }
diff --git a/core/launcher/transferserver.h b/core/launcher/transferserver.h
index 076e460..a3bb060 100644
--- a/core/launcher/transferserver.h
+++ b/core/launcher/transferserver.h
@@ -1,5 +1,5 @@
 /**********************************************************************
-** Copyright (C) 2000 Trolltech AS.  All rights reserved.
+** Copyright (C) 2000-2002 Trolltech AS.  All rights reserved.
 **
-** This file is part of Qtopia Environment.
+** This file is part of the Qtopia Environment.
 **
@@ -38,2 +38,16 @@ public:
 
+class SyncAuthentication : QObject
+{
+    Q_OBJECT
+
+public:
+    static int isAuthorized(QHostAddress peeraddress);
+    static bool checkPassword(const QString& pw);
+    static bool checkUser(const QString& user);
+
+    static QString serverId();
+    static QString loginName();
+    static QString ownerName();
+};
+
 
@@ -67,2 +81,3 @@ public:
     QByteArray buffer() { return buf.buffer(); }
+    QString fileName() const { return file.name(); }
 
@@ -133,4 +148,2 @@ protected slots:
 protected:
-    bool checkUser( const QString& user );
-    bool checkPassword( const QString& pw );
     bool checkReadFile( const QString& file );
@@ -166,3 +179 @@ private:
 };
-
-bool accessAuthorized(QHostAddress peeraddress);