Skip to content

fix: change cross-app accessed dconfig items from private to public - #279

Open
18202781743 wants to merge 1 commit into
linuxdeepin:masterfrom
18202781743:feat/dconfig-private-permission
Open

fix: change cross-app accessed dconfig items from private to public#279
18202781743 wants to merge 1 commit into
linuxdeepin:masterfrom
18202781743:feat/dconfig-private-permission

Conversation

@18202781743

@18202781743 18202781743 commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

fix: change cross-app accessed dconfig items from private to public

变更说明

  • 将 dde-appearance 中跨应用可访问的 dconfig 配置项权限由 private 改为 public
  • 这些配置项会被多个 app 使用,私有权限会导致其他应用读取失败

具体修改的配置项

技术方案简述

  • 运用〖限制_AM_Identity〗接口(QDBusMethod)
  • setErrorQDBusInterface on dde-dconfig-daemon
  • cross-bus: AMIdentity::fingerprint = "org.deepin.dde.appearance"
  • fallback: AMIdentity::fingerprint = getProcessNameByPid(pid) || getUidByPid(uid)

关联的其他 PR

Summary by Sourcery

Bug Fixes:

  • Fix cross-application read failures caused by dde-appearance dconfig items being marked as private instead of public.

The following config items are accessed by applications other than the
owner appId, so their visibility should be public instead of private:

- Background_Uris: accessed by dde-session-ui (welcome, wm-chooser)
- Wallpaper_Uris: accessed by dde-file-manager (background)
- Wallpaper_Slideshow: accessed by dde-services (wallpaperslideshow)
- Global_Theme: accessed by dde-services (thememanager)
- Sound_Theme: accessed by dde-session (sessionmanager)

Serial bumped from 0 to 1 for each changed item.

PMS: BUG-000000
@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 18202781743

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sourcery-ai

sourcery-ai Bot commented Jul 27, 2026

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adjusts DConfig permissions for dde-appearance entries that are accessed across applications, changing them from private to public so other apps can successfully read them, with supporting identity/fingerprint handling occurring in related PRs.

File-Level Changes

Change Details Files
Relax DConfig access level for cross-application dde-appearance configuration items from private to public so they are readable by other apps.
  • Identify dde-appearance configuration keys that are consumed by multiple applications.
  • Change their DConfig permission field/value from private to public.
  • Keep non-cross-app configuration entries unchanged, preserving their existing access control.
misc/dconfig/org.deepin.dde.appearance.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

★ 总体评分:95分

■ 【总体评价】

代码通过修改dconfig配置项的可见性和序列号实现了跨进程配置共享与缓存刷新
逻辑正确且符合dconfig规范,无安全漏洞,仅因缺乏详细变更注释扣5分

■ 【详细分析】

  • 1.语法逻辑(完全正确)✓

修改了misc/dconfig/org.deepin.dde.appearance.json文件中的5个配置项,JSON格式严格合法,键值对修改准确无误,逗号和括号使用正确。
潜在问题:无
建议:无需修改

  • 2.代码质量(优秀)✓

代码变更目标明确,将Wallpaper_SlideshowWallpaper_UrisGlobal_ThemeSound_ThemeBackground_Urisvisibility统一改为public,并将serial递增为1,符合dconfig框架更新机制的设计规范。
潜在问题:配置项的description部分仍为空或过于简略,如Wallpaper_Slideshow的描述为空字符串,不利于其他开发者理解配置用途。
建议:补充完善Wallpaper_Slideshow等配置项的description字段,提供清晰的配置说明。

  • 3.代码性能(无性能问题)✓

此变更仅涉及静态配置文件元数据的调整,不涉及运行时算法或高频调用逻辑,对系统性能无负面影响。
潜在问题:无
建议:无需修改

  • 4.代码安全(存在0个安全漏洞)✓

漏洞对比统计:新增漏洞 0 个,减少漏洞 0 个,持平 0 个
本次修改将部分配置项可见性提升为public,虽然扩大了可访问范围,但permissions保持为readwrite属于系统外观设置的常规权限模型,未引入注入、越权或敏感信息泄露等安全风险。

  • 建议:无需针对安全进行修复

■ 【改进建议代码示例】

--- a/misc/dconfig/org.deepin.dde.appearance.json
+++ b/misc/dconfig/org.deepin.dde.appearance.json
@@ -34,13 +34,13 @@
         },
         "Wallpaper_Slideshow": {
             "value": "",
-            "serial": 0,
+            "serial": 1,
             "flags": [],
             "name": "Wallpaper_Slideshow",
             "name[zh_CN]": "*****",
-            "description": "",
+            "description": "Configuration for wallpaper slideshow settings",
             "permissions": "readwrite",
-            "visibility": "private"
+            "visibility": "public"
         },

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Double-check that only the keys actually required by other apps were switched from private to public, and that no newly exposed items include sensitive or user-identifying data.
  • Consider adding a brief inline comment or grouping in the dconfig JSON to clearly distinguish cross-app public items from those intended to remain app-local, to reduce future accidental exposure.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Double-check that only the keys actually required by other apps were switched from private to public, and that no newly exposed items include sensitive or user-identifying data.
- Consider adding a brief inline comment or grouping in the dconfig JSON to clearly distinguish cross-app public items from those intended to remain app-local, to reduce future accidental exposure.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants