diff --git a/doc/changelog.asciidoc b/doc/changelog.asciidoc index f7ccc605c..1d266082d 100644 --- a/doc/changelog.asciidoc +++ b/doc/changelog.asciidoc @@ -38,6 +38,8 @@ Added mode. This mode uses less RAM, but the expense of performance. - New `content.webrtc_ip_handling_policy` setting, which allows more fine-grained/restrictive control about which IPs are exposed via WebRTC. +- Running qutebrowser with QtWebKit or Qt < 5.9 now shows a warning (only + once), as support for those is going to be removed in a future release. Changed ~~~~~~~ diff --git a/qutebrowser/app.py b/qutebrowser/app.py index db070770c..3429ed5f5 100644 --- a/qutebrowser/app.py +++ b/qutebrowser/app.py @@ -72,9 +72,9 @@ from qutebrowser.keyinput import macros from qutebrowser.mainwindow import mainwindow, prompt from qutebrowser.misc import (readline, ipc, savemanager, sessions, crashsignal, earlyinit, sql, cmdhistory, - backendproblem) + backendproblem, objects) from qutebrowser.utils import (log, version, message, utils, urlutils, objreg, - usertypes, standarddir, error) + usertypes, standarddir, error, qtutils) # pylint: disable=unused-import # We import those to run the cmdutils.register decorators. from qutebrowser.mainwindow.statusbar import command @@ -373,6 +373,13 @@ def _open_special_pages(args): 'qutebrowser.conf')), 'qute://help/configuring.html'), + ('webkit-warning-shown', + objects.backend == usertypes.Backend.QtWebKit, + 'qute://warning/webkit'), + + ('old-qt-warning-shown', + not qtutils.version_check('5.9'), + 'qute://warning/old-qt'), ] for state, condition, url in pages: diff --git a/qutebrowser/browser/qutescheme.py b/qutebrowser/browser/qutescheme.py index be6a09bab..0fa9366a6 100644 --- a/qutebrowser/browser/qutescheme.py +++ b/qutebrowser/browser/qutescheme.py @@ -39,7 +39,7 @@ except ImportError: # New in Python 3.6 secrets = None -from PyQt5.QtCore import QUrlQuery, QUrl +from PyQt5.QtCore import QUrlQuery, QUrl, qVersion import qutebrowser from qutebrowser.browser import pdfjs, downloads @@ -552,3 +552,19 @@ def qute_pdfjs(url): else: mimetype = utils.guess_mimetype(url.fileName(), fallback=True) return mimetype, data + + +@add_handler('warning') +def qute_warning(url): + """Handler for qute://warning.""" + path = url.path() + if path == '/old-qt': + src = jinja.render('warning-old-qt.html', + title='Old Qt warning', + qt_version=qVersion()) + elif path == '/webkit': + src = jinja.render('warning-webkit.html', + title='QtWebKit backend warning') + else: + raise NotFoundError("Invalid warning page {}".format(path)) + return 'text/html', src diff --git a/qutebrowser/html/styled.html b/qutebrowser/html/styled.html index f4d256422..52f7e1042 100644 --- a/qutebrowser/html/styled.html +++ b/qutebrowser/html/styled.html @@ -45,4 +45,13 @@ td { margin-left: 10px; text-decoration: none; } + +.note { + font-size: smaller; + color: grey; +} + +.mono { + font-family: monospace; +} {% endblock %} diff --git a/qutebrowser/html/warning-old-qt.html b/qutebrowser/html/warning-old-qt.html new file mode 100644 index 000000000..157d50714 --- /dev/null +++ b/qutebrowser/html/warning-old-qt.html @@ -0,0 +1,24 @@ +{% extends "styled.html" %} + +{% block content %} +

{{ title }}

+Note this warning will only appear once. Use :open +qute://warning/old-qt to show it again at a later time. + +

You're using qutebrowser with Qt {{qt_version}}.

+ +

Qt 5.7 was released in June 2016, with the 5.7.1 patch release in December +2016. It is based on Chromium 49 (March 2016) with (some) security fixes up to +Chromium 54 (October 2016). It is also +not covered +by Debian security updates.

+ +

Qt 5.8 has had various bugs, and has been unsupported (but working to some +degree) in qutebrowser for a while.

+ +

Because of those security issues and the maintaince burden coming with +supporting old versions, support for Qt < 5.9 will be dropped in a future +qutebrowser release. You might want to check +alternate installation methods +which allow you to get a newer Qt.

+{% endblock %} diff --git a/qutebrowser/html/warning-webkit.html b/qutebrowser/html/warning-webkit.html new file mode 100644 index 000000000..2797ea228 --- /dev/null +++ b/qutebrowser/html/warning-webkit.html @@ -0,0 +1,82 @@ +{% extends "styled.html" %} + +{% block content %} +

{{ title }}

+Note this warning will only appear once. Use :open +qute://warning/webkit to show it again at a later time. + +

You're using qutebrowser with the QtWebKit backend.

+ +

Unfortunately, QtWebKit hasn't seen a release (including security updates) +since June 2017, and it also lacks various security features (process +isolation/sandboxing) present in QtWebEngine.

+ +

Because of those security issues and the maintaince burden coming with +supporting QtWebKit, support for it will be dropped in a future qutebrowser +release. It's recommended that you use QtWebEngine instead.

+ +

(Outdated) reasons to use QtWebKit

+

Most reasons why people preferred the QtWebKit backend aren't relevant anymore:

+ +

PDF.js support: This qutebrowser release comes with PDF.js support +for QtWebEngine.

+ +

Missing control over Referer header: This qutebrowser release +supports content.headers.referer for QtWebEngine.

+ +

Missing control over cookies: With Qt 5.11 or newer, the content.cookies.accept setting works on QtWebEngine.

+ +

Graphical glitches: The new values for the qt.force_software_rendering setting added in v1.4.0 should +hopefully help.

+ +

Missing support for notifications: Those aren't supported yet in +Qt, but support is planned to be added in Qt 5.13, released around May 2019.

+ +

Resource usage: This release adds the qt.process_model and qt.low_end_device_mode settings which can be used to +decrease the resource usage of QtWebEngine (but come with other drawbacks).

+ +

Not trusting Google: Various people have checked the connections made +by QtWebEngine/qutebrowser, and it doesn't make any connections to Google (or +any other unsolicited connections at all). Arguably, having to trust Google +also is a smaller issue than having to trust every website you visit because of +heaps of security issues...

+ +

Nouveau graphic driver: You can use QtWebEngine with software +rendering. With Qt 5.13 (~May 2019) it might be possible to run with Nouveau +without software rendering.

+ +

Wayland: It's possible to use QtWebEngine with XWayland. Some users +also seem to be able to run it natively with Qt 5.11, but currently, QUTE_SKIP_WAYLAND_CHECK=1 needs to be set in the +environment to do so.

+ +

Instability on FreeBSD: Those seem to be FreeBSD-specific crashes, +and unfortunately nobody has looked into them yet so far...

+ +

QtWebEngine being unavailable in ArchlinuxARM's PyQt package: +QtWebEngine itself is available on the armv7h/aarch64 architectures, but their +PyQt package is broken and doesn't come with QtWebEngine support. This +has +been reported in their forums, but without any change so far. It should +however be possible to rebuild the PyQt package from source with QtWebEngine +installed.

+ +

QtWebEngine being unavailable on Parabola: Claims of Parabola +developers about QtWebEngine being "non-free" have repeatedly been disputed, +and so far nobody came up with solid evidence about that being the case. Also, +note that their qutebrowser package is orphaned and was often outdated in the +past (even qutebrowser security fixes took months to arrive there). You +might be better off chosing an alternative install +method.

+ +

White flashing between loads with a custom stylesheet: This doesn't +seem to happen with qt.process_model = single-process +set. However, note that that setting comes with decreased security and +stability, but QtWebKit doesn't have any process isolation at all.

+{% endblock %}