Merge branch '4.13'

2 files changed, 6 insertions, 2 deletions

diff --git a/cura_app.py b/cura_app.py
index b9a42f0aba..1520d2da67 100755
--- a/cura_app.py
+++ b/cura_app.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright (c) 2020 Ultimaker B.V.
+# Copyright (c) 2022 Ultimaker B.V.
 # Cura is released under the terms of the LGPLv3 or higher.
 
 # Remove the working directory from sys.path.
@@ -15,6 +15,9 @@ if "" in sys.path:
 import argparse
 import faulthandler
 import os
+if sys.platform != "linux":  # Turns out the Linux build _does_ use this, but we're not making an Enterprise release for that system anyway.
+    os.environ["QT_PLUGIN_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
+    os.environ["QML2_IMPORT_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
 
 from PyQt5.QtNetwork import QSslConfiguration, QSslSocket
 
diff --git a/resources/texts/change_log.txt b/resources/texts/change_log.txt
index 8cdcdd168e..47e39adbaa 100644
--- a/resources/texts/change_log.txt
+++ b/resources/texts/change_log.txt
@@ -1,4 +1,4 @@
-[4.13]
+[4.13.0]
 <i>For an overview of the new features in Cura 4.13, please watch <a href="https://youtu.be/chvAuI6Eqto">our video</a>.</i>
 
 * Sync material profiles 
@@ -56,6 +56,7 @@ We’ve streamlined the user login authentication by removing any restrictions,
 - Fixed a bug where support blockers were included in the bounding box after loading a project file
 - Fixed a bug where grouped models become unslicable if the first extruder was disabled
 - Fixed a bug in Tree Support where the Z Distance was too big
+- Prevented QT plug-ins from being loaded from an insecure directory if an environment variable is set
 
 * Printer definitions, profiles and materials:
 - Add Eazao Zero printer definition, contributed by Hogan-Polaris