From b86a7917bfa3317b1b49db39ccd3ff0e17f19cab Mon Sep 17 00:00:00 2001
From: Mrmaxmeier <Mrmaxmeier@gmail.com>
Date: Fri, 28 Nov 2025 17:31:30 +0100
Subject: [PATCH] kdePackages.kdeconnect-kde: fix CVE-2025-66270

---
 pkgs/kde/gear/kdeconnect-kde/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/kde/gear/kdeconnect-kde/default.nix b/pkgs/kde/gear/kdeconnect-kde/default.nix
index a9c95f7b6fb5..795cc5b7106e 100644
--- a/pkgs/kde/gear/kdeconnect-kde/default.nix
+++ b/pkgs/kde/gear/kdeconnect-kde/default.nix
@@ -10,6 +10,7 @@
   wayland,
   wayland-protocols,
   libfakekey,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "kdeconnect-kde";
@@ -18,6 +19,12 @@ mkKdeDerivation {
     (replaceVars ./hardcode-sshfs-path.patch {
       sshfs = lib.getExe sshfs;
     })
+    # Fix CVE-2025-66270 (https://kde.org/info/security/advisory-20251128-1.txt)
+    (fetchpatch {
+      name = "CVE-2025-66270.patch";
+      url = "https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e.patch";
+      hash = "sha256-qtcXNJ5qL4xtZQ70R/wWVCzFGzXNltr6XTgs0fpkTi4=";
+    })
   ];
 
   # Hardcoded as a QString, which is UTF-16 so Nix can't pick it up automatically