configure.ac                                         |    2 
 connectivity/source/drivers/hsqldb/HDriver.cxx       |   31 ++++
 download.lst                                         |   20 +--
 embeddedobj/source/commonembedding/embedobj.cxx      |   60 ++++-----
 embeddedobj/source/commonembedding/specialobject.cxx |    9 +
 embeddedobj/source/inc/commonembobj.hxx              |    3 
 embeddedobj/source/inc/specialobject.hxx             |    7 +
 external/curl/curl-7.26.0_win-proxy.patch            |    9 -
 external/curl/curl-msvc-disable-protocols.patch.1    |    2 
 external/curl/curl-nss.patch.1                       |    6 
 external/curl/zlib.patch.0                           |   12 -
 external/hsqldb/UnpackedTarball_hsqldb.mk            |    1 
 external/hsqldb/patches/disable-dump-script.patch    |   14 ++
 formula/source/core/api/token.cxx                    |   13 --
 include/svx/svdoole2.hxx                             |   17 ++
 include/svx/unoshape.hxx                             |    2 
 sc/source/core/inc/interpre.hxx                      |   12 +
 sc/source/core/tool/interpr1.cxx                     |    4 
 sc/source/core/tool/interpr3.cxx                     |    4 
 sc/source/core/tool/interpr4.cxx                     |   10 +
 sc/source/ui/docshell/documentlinkmgr.cxx            |    9 +
 sfx2/source/doc/iframe.cxx                           |   69 ++++++----
 svx/source/svdraw/svdoole2.cxx                       |  123 ++++++++++++++-----
 svx/source/unodraw/shapeimpl.hxx                     |    5 
 svx/source/unodraw/unoshap4.cxx                      |   23 +++
 sw/inc/ndole.hxx                                     |    4 
 sw/qa/extras/htmlexport/htmlexport.cxx               |   16 +-
 sw/source/core/inc/frmtool.hxx                       |    1 
 sw/source/core/layout/flowfrm.cxx                    |   20 +++
 sw/source/core/layout/sectfrm.cxx                    |    3 
 sw/source/core/ole/ndole.cxx                         |   99 +++++++++++++--
 xmloff/source/draw/ximpshap.cxx                      |   29 ++++
 xmloff/source/draw/ximpshap.hxx                      |    2 
 33 files changed, 493 insertions(+), 148 deletions(-)

New commits:
commit 2bcf1b7c21ef9b343c148d4e11566b868321d5d2
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Apr 20 20:58:21 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Mon May 15 00:06:27 2023 +0200

    assume IFrame script/macro support isn't needed
    
    seems undocumented at least
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151020
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit a10a5994bddf7646196ff45f6af598420d8663ad)
    
    Change-Id: I316e4f4f25ddb7cf6b7bac4d856a721b987207a3

diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
index 621f728edea9..12ea3b104a20 100644
--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
@@ -167,20 +167,16 @@ sal_Bool SAL_CALL IFrameObject::load(
         uno::Reference < util::XURLTransformer > xTrans( 
util::URLTransformer::create( mxContext ) );
         xTrans->parseStrict( aTargetURL );
 
+        INetURLObject aURLObject(aTargetURL.Complete);
+        if (aURLObject.GetProtocol() == INetProtocol::Macro || 
aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
+            return false;
+
         uno::Reference<frame::XFramesSupplier> xParentFrame = 
xFrame->getCreator();
         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
 
-        if (INetURLObject(aTargetURL.Complete).GetProtocol() == 
INetProtocol::Macro)
-        {
-            if (pDoc && !pDoc->AdjustMacroMode())
-                return false;
-        }
-
         bool bUpdateAllowed(true);
         if (pDoc)
         {
-            // perhaps should only check for file targets, but lets default to 
making it strong
-            // unless there is a known need to distinguish
             comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = 
pDoc->getEmbeddedObjectContainer();
             bUpdateAllowed = 
rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
         }
commit 302b47e2631deaf007bcb6240d31f22d9eeb5359
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Thu Apr 13 11:31:17 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:59:51 2023 +0200

    put floating frames under managed links control
    
    like we do for sections and ole objects that link to their content
    
    individual commits in trunk are:
    
    extract a OCommonEmbeddedObject::SetInplaceActiveState for reuse
    
    no behaviour change intended
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150341
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 183e34a3f8c429c0698951e24c17844e416a3825)
    
    use parent window as dialog parent
    
    it makes no odds, but is more convenient for upcoming modification
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150342
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit f93edf343658abd489bde3639d2ffaefd50c0f99)
    
    adjust IFrameObject so it could reuse mxFrame for a reload of content
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150343
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 3a727d26fd9eb6fa140bc3f5cadf3db079d42206)
    
    query getUserAllowsLinkUpdate for the case of content in a floating frame
    
    similarly to how it works for the more common "normal" embedded objects
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149971
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 52aa46468531918eabfa2031dedf50377ae72cf7)
    
    add a route to get writer Floating Frame links under 'manage links'
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150349
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 8b8a2844addbd262befb1a2d193dfb590dfa20be)
    
    allow SvxOle2Shape::resetModifiedState to survive having no SdrObject
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150538
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 02379929bd0e1d1676635f0ca1920422702ebb7c)
    
    create the FloatingFrameShape in a separate step to inserting it
    
    this is derived from the path taken by the AddShape(const OUString&)
    function for this case. No change in behavior is intended.
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150526
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit bafec47847a0b9697b3bbe9358e53f8118af3024)
    
    add a route to get calc Floating Frame links under 'manage links'
    
    much harder than writer because the organization and ordering
    of properties and object activation etc is different.
    
    This ended up ugly, but functions.
    
    We set FrameURL before AddShape, we have to do it again later because it
    gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
    FrameURL to exist when AddShape triggers SetPersistName which itself
    triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
    know what URL will end up being used. So bodge this by setting FrameURL
    to the temp pre-SdrOle2Obj attached properties and we can smuggle it
    eventually into SdrOle2Obj::SetPersistName at the right point after
    PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
    in order to inform the link manager that this is an IFrame that links to
    a URL
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150539
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 07179a5a5bd00f34acfa8a3f260dd834ae003c63)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150755
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit b91ea614c0b753ab3d378acd0e2db8262e9dbd72)
    
    bc5333b137d2da089b3b701ff615c6ddf43063d0
    7eec3132a23faafd9a2878215a0a117a67bc9bf2
    83e38dfa2f84907c2de9680e91f779d34864a9ad
    f90ff71d6a96342574799312f764badaf97980eb
    ea059262c124e3f44249e49b4189732310d28156
    d09ae0c65a55a37743ad7c184070fb8dd97d8a7f
    67fc199fef9e67fa12ca7873f0fe12137aa16d8f
    
    Change-Id: Ia1d12aa5c9afdc1347f6d4364bc6a0b7f41ee168

diff --git a/embeddedobj/source/commonembedding/embedobj.cxx 
b/embeddedobj/source/commonembedding/embedobj.cxx
index 8c888df48a9e..eaa8789e6fe0 100644
--- a/embeddedobj/source/commonembedding/embedobj.cxx
+++ b/embeddedobj/source/commonembedding/embedobj.cxx
@@ -155,6 +155,37 @@ void OCommonEmbeddedObject::StateChangeNotification_Impl( 
bool bBeforeChange, sa
     }
 }
 
+void OCommonEmbeddedObject::SetInplaceActiveState()
+{
+    if ( !m_xClientSite.is() )
+        throw embed::WrongStateException( "client site not set, yet", *this );
+
+    uno::Reference< embed::XInplaceClient > xInplaceClient( m_xClientSite, 
uno::UNO_QUERY );
+    if ( !xInplaceClient.is() || !xInplaceClient->canInplaceActivate() )
+        throw embed::WrongStateException(); //TODO: can't activate inplace
+    xInplaceClient->activatingInplace();
+
+    uno::Reference< embed::XWindowSupplier > xClientWindowSupplier( 
xInplaceClient, uno::UNO_QUERY_THROW );
+
+    m_xClientWindow = xClientWindowSupplier->getWindow();
+    m_aOwnRectangle = xInplaceClient->getPlacement();
+    m_aClipRectangle = xInplaceClient->getClipRectangle();
+    awt::Rectangle aRectangleToShow = GetRectangleInterception( 
m_aOwnRectangle, m_aClipRectangle );
+
+    // create own window based on the client window
+    // place and resize the window according to the rectangles
+    uno::Reference< awt::XWindowPeer > xClientWindowPeer( m_xClientWindow, 
uno::UNO_QUERY_THROW );
+
+    // dispatch provider may not be provided
+    uno::Reference< frame::XDispatchProvider > xContainerDP = 
xInplaceClient->getInplaceDispatchProvider();
+    bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, aRectangleToShow, 
xContainerDP );
+    m_nObjectState = embed::EmbedStates::INPLACE_ACTIVE;
+    if ( !bOk )
+    {
+        SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
+        throw embed::WrongStateException(); //TODO: can't activate inplace
+    }
+}
 
 void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 nNextState )
 {
@@ -229,34 +260,7 @@ void OCommonEmbeddedObject::SwitchStateTo_Impl( sal_Int32 
nNextState )
         {
             if ( nNextState == embed::EmbedStates::INPLACE_ACTIVE )
             {
-                if ( !m_xClientSite.is() )
-                    throw embed::WrongStateException( "client site not set, 
yet", *this );
-
-                uno::Reference< embed::XInplaceClient > xInplaceClient( 
m_xClientSite, uno::UNO_QUERY );
-                if ( !xInplaceClient.is() || 
!xInplaceClient->canInplaceActivate() )
-                    throw embed::WrongStateException(); //TODO: can't activate 
inplace
-                xInplaceClient->activatingInplace();
-
-                uno::Reference< embed::XWindowSupplier > 
xClientWindowSupplier( xInplaceClient, uno::UNO_QUERY_THROW );
-
-                m_xClientWindow = xClientWindowSupplier->getWindow();
-                m_aOwnRectangle = xInplaceClient->getPlacement();
-                m_aClipRectangle = xInplaceClient->getClipRectangle();
-                awt::Rectangle aRectangleToShow = GetRectangleInterception( 
m_aOwnRectangle, m_aClipRectangle );
-
-                // create own window based on the client window
-                // place and resize the window according to the rectangles
-                uno::Reference< awt::XWindowPeer > xClientWindowPeer( 
m_xClientWindow, uno::UNO_QUERY_THROW );
-
-                // dispatch provider may not be provided
-                uno::Reference< frame::XDispatchProvider > xContainerDP = 
xInplaceClient->getInplaceDispatchProvider();
-                bool bOk = m_xDocHolder->ShowInplace( xClientWindowPeer, 
aRectangleToShow, xContainerDP );
-                m_nObjectState = nNextState;
-                if ( !bOk )
-                {
-                    SwitchStateTo_Impl( embed::EmbedStates::RUNNING );
-                    throw embed::WrongStateException(); //TODO: can't activate 
inplace
-                }
+                SetInplaceActiveState();
             }
             else if ( nNextState == embed::EmbedStates::ACTIVE )
             {
diff --git a/embeddedobj/source/commonembedding/specialobject.cxx 
b/embeddedobj/source/commonembedding/specialobject.cxx
index a1e55d87debe..e5e7504ef3d2 100644
--- a/embeddedobj/source/commonembedding/specialobject.cxx
+++ b/embeddedobj/source/commonembedding/specialobject.cxx
@@ -57,6 +57,7 @@ uno::Any SAL_CALL OSpecialEmbeddedObject::queryInterface( 
const uno::Type& rType
     uno::Any aReturn = ::cppu::queryInterface( rType,
                                         static_cast< embed::XEmbeddedObject* 
>( this ),
                                         static_cast< embed::XInplaceObject* >( 
this ),
+                                        static_cast< 
embed::XCommonEmbedPersist* >( static_cast< embed::XEmbedPersist* >( this ) ),
                                         static_cast< embed::XVisualObject* >( 
this ),
                                         static_cast< embed::XClassifiedObject* 
>( this ),
                                         static_cast< 
embed::XComponentSupplier* >( this ),
@@ -170,4 +171,12 @@ void SAL_CALL OSpecialEmbeddedObject::doVerb( sal_Int32 
nVerbID )
         OCommonEmbeddedObject::doVerb( nVerbID );
 }
 
+void SAL_CALL OSpecialEmbeddedObject::reload(
+                const uno::Sequence< beans::PropertyValue >&,
+                const uno::Sequence< beans::PropertyValue >&)
+{
+    // Allow IFrames to reload their content
+    SetInplaceActiveState();
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/embeddedobj/source/inc/commonembobj.hxx 
b/embeddedobj/source/inc/commonembobj.hxx
index c00fbdc096be..78e46e0c0c89 100644
--- a/embeddedobj/source/inc/commonembobj.hxx
+++ b/embeddedobj/source/inc/commonembobj.hxx
@@ -231,6 +231,9 @@ private:
                     const css::uno::Sequence< css::beans::PropertyValue >& 
lArguments,
                     const css::uno::Sequence< css::beans::PropertyValue >& 
lObjArgs );
 
+protected:
+    void SetInplaceActiveState();
+
 public:
     OCommonEmbeddedObject(
         const css::uno::Reference< css::uno::XComponentContext >& rxContext,
diff --git a/embeddedobj/source/inc/specialobject.hxx 
b/embeddedobj/source/inc/specialobject.hxx
index 32ad61a7a582..4c4bc70db377 100644
--- a/embeddedobj/source/inc/specialobject.hxx
+++ b/embeddedobj/source/inc/specialobject.hxx
@@ -48,6 +48,13 @@ public:
     virtual void SAL_CALL changeState( sal_Int32 nNewState ) override;
 
     virtual void SAL_CALL doVerb( sal_Int32 nVerbID ) override;
+
+// XCommonEmbedPersist
+
+    virtual void SAL_CALL reload(
+                const css::uno::Sequence< css::beans::PropertyValue >& 
lArguments,
+                const css::uno::Sequence< css::beans::PropertyValue >& 
lObjArgs ) override;
+
 };
 
 #endif
diff --git a/include/svx/svdoole2.hxx b/include/svx/svdoole2.hxx
index a897b797694d..3d289d5af84e 100644
--- a/include/svx/svdoole2.hxx
+++ b/include/svx/svdoole2.hxx
@@ -42,6 +42,7 @@ namespace frame { class XModel; }
 namespace svt { class EmbeddedObjectRef; }
 
 class SdrOle2ObjImpl;
+class SvxOle2Shape;
 
 class SVX_DLLPUBLIC SdrOle2Obj : public SdrRectObj
 {
@@ -49,7 +50,7 @@ private:
     std::unique_ptr<SdrOle2ObjImpl> mpImpl;
 
 private:
-    SVX_DLLPRIVATE void Connect_Impl();
+    SVX_DLLPRIVATE void Connect_Impl(SvxOle2Shape* pCreator = nullptr);
     SVX_DLLPRIVATE void Disconnect_Impl();
     SVX_DLLPRIVATE void AddListeners_Impl();
     SVX_DLLPRIVATE void RemoveListeners_Impl();
@@ -105,7 +106,7 @@ public:
     // OLE object has got a separate PersistName member now;
     // !!! use ::SetPersistName( ... ) only, if you know what you do !!!
     const OUString& GetPersistName() const;
-    void        SetPersistName( const OUString& rPersistName );
+    void        SetPersistName( const OUString& rPersistName, SvxOle2Shape* 
pCreator = nullptr );
 
     // One can add an application name to a SdrOle2Obj, which can be queried 
for
     // later on (SD needs this for presentation objects).
@@ -153,7 +154,7 @@ public:
                                          sal_Int64 nAspect );
     static bool Unload( const css::uno::Reference< css::embed::XEmbeddedObject 
>& xObj, sal_Int64 nAspect );
     bool Unload();
-    void Connect();
+    void Connect(SvxOle2Shape* pCreator = nullptr);
     void Disconnect();
     void ObjectLoaded();
 
@@ -200,6 +201,16 @@ public:
     void                Connect() { GetRealObject(); }
 };
 
+class SVX_DLLPUBLIC SdrIFrameLink final : public sfx2::SvBaseLink
+{
+    SdrOle2Obj* m_pObject;
+
+public:
+    explicit SdrIFrameLink(SdrOle2Obj* pObject);
+    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
+        const OUString& rMimeType, const css::uno::Any & rValue ) override;
+};
+
 #endif // INCLUDED_SVX_SVDOOLE2_HXX
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/include/svx/unoshape.hxx b/include/svx/unoshape.hxx
index 60917bf7d893..6bbbe5b56502 100644
--- a/include/svx/unoshape.hxx
+++ b/include/svx/unoshape.hxx
@@ -605,6 +605,8 @@ public:
     bool createObject( const SvGlobalName &aClassName );
 
     void createLink( const OUString& aLinkURL );
+
+    virtual OUString GetAndClearInitialFrameURL();
 };
 
 
diff --git a/sc/source/ui/docshell/documentlinkmgr.cxx 
b/sc/source/ui/docshell/documentlinkmgr.cxx
index 479d1b0e56b2..7021e9fecd26 100644
--- a/sc/source/ui/docshell/documentlinkmgr.cxx
+++ b/sc/source/ui/docshell/documentlinkmgr.cxx
@@ -142,7 +142,7 @@ bool DocumentLinkManager::hasDdeOrOleOrWebServiceLinks(bool 
bDde, bool bOle, boo
         sfx2::SvBaseLink* pBase = rLink.get();
         if (bDde && dynamic_cast<ScDdeLink*>(pBase))
             return true;
-        if (bOle && dynamic_cast<SdrEmbedObjectLink*>(pBase))
+        if (bOle && (dynamic_cast<SdrEmbedObjectLink*>(pBase) || 
dynamic_cast<SdrIFrameLink*>(pBase)))
             return true;
         if (bWebService && dynamic_cast<ScWebServiceLink*>(pBase))
             return true;
@@ -173,6 +173,13 @@ bool 
DocumentLinkManager::updateDdeOrOleOrWebServiceLinks(weld::Window* pWin)
             continue;
         }
 
+        SdrIFrameLink* pIFrameLink = dynamic_cast<SdrIFrameLink*>(pBase);
+        if (pIFrameLink)
+        {
+            pIFrameLink->Update();
+            continue;
+        }
+
         ScWebServiceLink* pWebserviceLink = 
dynamic_cast<ScWebServiceLink*>(pBase);
         if (pWebserviceLink)
         {
diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
index c1092ed3d1cd..621f728edea9 100644
--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
@@ -176,31 +176,46 @@ sal_Bool SAL_CALL IFrameObject::load(
                 return false;
         }
 
+        bool bUpdateAllowed(true);
+        if (pDoc)
+        {
+            // perhaps should only check for file targets, but lets default to 
making it strong
+            // unless there is a known need to distinguish
+            comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = 
pDoc->getEmbeddedObjectContainer();
+            bUpdateAllowed = 
rEmbeddedObjectContainer.getUserAllowsLinkUpdate();
+        }
+        if (!bUpdateAllowed)
+            return false;
+
         OUString sReferer;
         if (pDoc && pDoc->HasName())
             sReferer = pDoc->GetMedium()->GetName();
 
-        DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
-        VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( 
xFrame->getContainerWindow() );
-        VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( 
pParent, maFrmDescr.IsFrameBorderOn() );
-        pWin->SetSizePixel( pParent->GetOutputSizePixel() );
-        pWin->SetBackground();
-        pWin->Show();
-
-        uno::Reference < awt::XWindow > xWindow( 
pWin->GetComponentInterface(), uno::UNO_QUERY );
-        xFrame->setComponent( xWindow, uno::Reference < frame::XController >() 
);
+        uno::Reference<css::awt::XWindow> 
xParentWindow(xFrame->getContainerWindow());
 
-        // we must destroy the IFrame before the parent is destroyed
-        xWindow->addEventListener( this );
-
-        mxFrame = frame::Frame::create( mxContext );
-        uno::Reference < awt::XWindow > xWin( pWin->GetComponentInterface(), 
uno::UNO_QUERY );
-        mxFrame->initialize( xWin );
-        mxFrame->setName( maFrmDescr.GetName() );
-
-        uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, 
uno::UNO_QUERY );
-        if ( xFramesSupplier.is() )
-            mxFrame->setCreator( xFramesSupplier );
+        if (!mxFrame.is())
+        {
+            VclPtr<vcl::Window> pParent = 
VCLUnoHelper::GetWindow(xParentWindow);
+            VclPtr<IFrameWindow_Impl> pWin = 
VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() );
+            pWin->SetSizePixel( pParent->GetOutputSizePixel() );
+            pWin->SetBackground();
+            pWin->Show();
+
+            uno::Reference < awt::XWindow > xWindow( 
pWin->GetComponentInterface(), uno::UNO_QUERY );
+            xFrame->setComponent( xWindow, uno::Reference < frame::XController 
>() );
+
+            // we must destroy the IFrame before the parent is destroyed
+            xWindow->addEventListener( this );
+
+            mxFrame = frame::Frame::create( mxContext );
+            uno::Reference < awt::XWindow > xWin( 
pWin->GetComponentInterface(), uno::UNO_QUERY );
+            mxFrame->initialize( xWin );
+            mxFrame->setName( maFrmDescr.GetName() );
+
+            uno::Reference < frame::XFramesSupplier > xFramesSupplier( xFrame, 
uno::UNO_QUERY );
+            if ( xFramesSupplier.is() )
+                mxFrame->setCreator( xFramesSupplier );
+        }
 
         uno::Sequence < beans::PropertyValue > aProps(3);
         aProps[0].Name = "PluginMode";
diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
index c4d6f49c5db0..5fd8f977f8e6 100644
--- a/svx/source/svdraw/svdoole2.cxx
+++ b/svx/source/svdraw/svdoole2.cxx
@@ -77,6 +77,8 @@
 #include <sdr/contact/viewcontactofsdrole2obj.hxx>
 #include <svx/svdograf.hxx>
 #include <sdr/properties/oleproperties.hxx>
+#include <svx/unoshape.hxx>
+#include <svx/xlineit0.hxx>
 #include <svx/xlnclit.hxx>
 #include <svx/xbtmpit.hxx>
 #include <svx/xflbmtit.hxx>
@@ -595,6 +597,35 @@ void SdrEmbedObjectLink::Closed()
     SvBaseLink::Closed();
 }
 
+SdrIFrameLink::SdrIFrameLink(SdrOle2Obj* pObject)
+    : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, 
SotClipboardFormatId::SVXB)
+    , m_pObject(pObject)
+{
+    SetSynchron( false );
+}
+
+::sfx2::SvBaseLink::UpdateResult SdrIFrameLink::DataChanged(
+    const OUString&, const uno::Any& )
+{
+    uno::Reference<embed::XEmbeddedObject> xObject = m_pObject->GetObjRef();
+    uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, 
uno::UNO_QUERY);
+    if (xPersObj.is())
+    {
+        // let the IFrameObject reload the link
+        try
+        {
+            xPersObj->reload(uno::Sequence<beans::PropertyValue>(), 
uno::Sequence<beans::PropertyValue>());
+        }
+        catch (const uno::Exception&)
+        {
+        }
+
+        m_pObject->SetChanged();
+    }
+
+    return SUCCESS;
+}
+
 class SdrOle2ObjImpl
 {
 public:
@@ -612,7 +643,7 @@ public:
     bool mbLoadingOLEObjectFailed:1; // New local var to avoid repeated 
loading if load of OLE2 fails
     bool mbConnected:1;
 
-    SdrEmbedObjectLink* mpObjectLink;
+    sfx2::SvBaseLink* mpObjectLink;
     OUString maLinkURL;
 
     rtl::Reference<SvxUnoShapeModifyListener> mxModifyListener;
@@ -812,7 +843,7 @@ bool SdrOle2Obj::IsEmpty() const
     return !mpImpl->mxObjRef.is();
 }
 
-void SdrOle2Obj::Connect()
+void SdrOle2Obj::Connect(SvxOle2Shape* pCreator)
 {
     if( IsEmptyPresObj() )
         return;
@@ -825,7 +856,7 @@ void SdrOle2Obj::Connect()
         return;
     }
 
-    Connect_Impl();
+    Connect_Impl(pCreator);
     AddListeners_Impl();
 }
 
@@ -922,39 +953,66 @@ void SdrOle2Obj::DisconnectFileLink_Impl()
 
 void SdrOle2Obj::CheckFileLink_Impl()
 {
-    if (mpImpl->mxObjRef.GetObject().is() && !mpImpl->mpObjectLink)
+    if (!(mpImpl->mxObjRef.GetObject().is() && !mpImpl->mpObjectLink))
+        return;
+
+    try
     {
-        try
-        {
-            uno::Reference< embed::XLinkageSupport > xLinkSupport( 
mpImpl->mxObjRef.GetObject(), uno::UNO_QUERY );
+        uno::Reference<embed::XEmbeddedObject> xObject = 
mpImpl->mxObjRef.GetObject();
+        if (!xObject)
+            return;
+
+        bool bIFrame = false;
 
-            if ( xLinkSupport.is() && xLinkSupport->isLink() )
+        OUString aLinkURL;
+        uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, 
uno::UNO_QUERY);
+        if (xLinkSupport)
+        {
+            if (xLinkSupport->isLink())
+                aLinkURL = xLinkSupport->getLinkURL();
+        }
+        else
+        {
+            // get IFrame (Floating Frames) listed and updatable from the
+            // manage links dialog
+            SvGlobalName aClassId(xObject->getClassID());
+            if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
             {
-                OUString aLinkURL = xLinkSupport->getLinkURL();
+                uno::Reference<beans::XPropertySet> 
xSet(xObject->getComponent(), uno::UNO_QUERY);
+                if (xSet.is())
+                    xSet->getPropertyValue("FrameURL") >>= aLinkURL;
+                bIFrame = true;
+            }
+        }
 
-                if ( !aLinkURL.isEmpty() )
-                {
-                    // this is a file link so the model link manager should 
handle it
-                    sfx2::LinkManager* 
pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
+        if (!aLinkURL.isEmpty()) // this is a file link so the model link 
manager should handle it
+        {
+            sfx2::LinkManager* 
pLinkManager(getSdrModelFromSdrObject().GetLinkManager());
 
-                    if ( pLinkManager )
-                    {
-                        mpImpl->mpObjectLink = new SdrEmbedObjectLink( this );
-                        mpImpl->maLinkURL = aLinkURL;
-                        pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, 
OBJECT_CLIENT_OLE, aLinkURL );
-                        mpImpl->mpObjectLink->Connect();
-                    }
+            if ( pLinkManager )
+            {
+                SdrEmbedObjectLink* pEmbedObjectLink = nullptr;
+                if (!bIFrame)
+                {
+                    pEmbedObjectLink = new SdrEmbedObjectLink(this);
+                    mpImpl->mpObjectLink = pEmbedObjectLink;
                 }
+                else
+                    mpImpl->mpObjectLink = new SdrIFrameLink(this);
+                mpImpl->maLinkURL = aLinkURL;
+                pLinkManager->InsertFileLink( *mpImpl->mpObjectLink, 
OBJECT_CLIENT_OLE, aLinkURL );
+                if (pEmbedObjectLink)
+                    pEmbedObjectLink->Connect();
             }
         }
-        catch (const css::uno::Exception& e)
-        {
-            SAL_WARN("svx", "SdrOle2Obj::CheckFileLink_Impl(), " << e);
-        }
+    }
+    catch (const css::uno::Exception& e)
+    {
+        SAL_WARN("svx", "SdrOle2Obj::CheckFileLink_Impl(), " << e);
     }
 }
 
-void SdrOle2Obj::Connect_Impl()
+void SdrOle2Obj::Connect_Impl(SvxOle2Shape* pCreator)
 {
     if(!mpImpl->aPersistName.isEmpty() )
     {
@@ -994,6 +1052,17 @@ void SdrOle2Obj::Connect_Impl()
                 }
             }
 
+            if (pCreator)
+            {
+                OUString sFrameURL(pCreator->GetAndClearInitialFrameURL());
+                if (!sFrameURL.isEmpty() && 
svt::EmbeddedObjectRef::TryRunningState(mpImpl->mxObjRef.GetObject()))
+                {
+                    uno::Reference<beans::XPropertySet> 
xSet(mpImpl->mxObjRef->getComponent(), uno::UNO_QUERY);
+                    if (xSet.is())
+                        xSet->setPropertyValue("FrameURL", 
uno::Any(sFrameURL));
+                }
+            }
+
             if ( mpImpl->mxObjRef.is() )
             {
                 if ( !mpImpl->mxLightClient.is() )
@@ -1313,14 +1382,14 @@ SdrObject* SdrOle2Obj::getFullDragClone() const
     return createSdrGrafObjReplacement(false);
 }
 
-void SdrOle2Obj::SetPersistName( const OUString& rPersistName )
+void SdrOle2Obj::SetPersistName( const OUString& rPersistName, SvxOle2Shape* 
pCreator )
 {
     DBG_ASSERT( mpImpl->aPersistName.isEmpty(), "Persist name changed!");
 
     mpImpl->aPersistName = rPersistName;
     mpImpl->mbLoadingOLEObjectFailed = false;
 
-    Connect();
+    Connect(pCreator);
     SetChanged();
 }
 
diff --git a/svx/source/unodraw/shapeimpl.hxx b/svx/source/unodraw/shapeimpl.hxx
index 9b0a713184fa..23a886036f32 100644
--- a/svx/source/unodraw/shapeimpl.hxx
+++ b/svx/source/unodraw/shapeimpl.hxx
@@ -62,8 +62,11 @@ public:
 
     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
 };
+
 class SvxFrameShape : public SvxOle2Shape
 {
+private:
+    OUString m_sInitialFrameURL;
 protected:
     // override these for special property handling in subcasses. Return true 
if property is handled
     virtual bool setPropertyValueImpl( const OUString& rName, const 
SfxItemPropertySimpleEntry* pProperty, const css::uno::Any& rValue ) override;
@@ -80,6 +83,8 @@ public:
     virtual void SAL_CALL setPropertyValues( const css::uno::Sequence< 
OUString >& aPropertyNames, const css::uno::Sequence< css::uno::Any >& aValues 
) override;
 
     virtual void Create( SdrObject* pNewOpj, SvxDrawPage* pNewPage ) override;
+
+    virtual OUString GetAndClearInitialFrameURL() override;
 };
 
 
diff --git a/svx/source/unodraw/unoshap4.cxx b/svx/source/unodraw/unoshap4.cxx
index 158b8f2e1cce..2187285547ef 100644
--- a/svx/source/unodraw/unoshap4.cxx
+++ b/svx/source/unodraw/unoshap4.cxx
@@ -180,7 +180,7 @@ bool SvxOle2Shape::setPropertyValueImpl( const OUString& 
rName, const SfxItemPro
 #else
             pOle = static_cast<SdrOle2Obj*>(GetSdrObject());
 #endif
-            pOle->SetPersistName( aPersistName );
+            pOle->SetPersistName( aPersistName, this );
             return true;
         }
         break;
@@ -501,10 +501,11 @@ void SvxOle2Shape::createLink( const OUString& aLinkURL )
 
 void SvxOle2Shape::resetModifiedState()
 {
-    ::comphelper::IEmbeddedHelper* pPersist = 
GetSdrObject()->getSdrModelFromSdrObject().GetPersist();
+    SdrObject* pObject = GetSdrObject();
+    ::comphelper::IEmbeddedHelper* pPersist = pObject ? 
pObject->getSdrModelFromSdrObject().GetPersist() : nullptr;
     if( pPersist && !pPersist->isEnableSetModified() )
     {
-        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >( GetSdrObject() );
+        SdrOle2Obj* pOle = dynamic_cast< SdrOle2Obj* >(pObject);
         if( pOle && !pOle->IsEmpty() )
         {
             uno::Reference < util::XModifiable > xMod( pOle->GetObjRef(), 
uno::UNO_QUERY );
@@ -554,6 +555,11 @@ const SvGlobalName 
SvxOle2Shape::GetClassName_Impl(OUString& rHexCLSID)
     return aClassName;
 }
 
+OUString SvxOle2Shape::GetAndClearInitialFrameURL()
+{
+    return OUString();
+}
+
 SvxAppletShape::SvxAppletShape(SdrObject* pObject)
     : SvxOle2Shape( pObject, getSvxMapProvider().GetMap(SVXMAP_APPLET), 
getSvxMapProvider().GetPropertySet(SVXMAP_APPLET, 
SdrObject::GetGlobalDrawObjectItemPool())  )
 {
@@ -707,8 +713,19 @@ SvxFrameShape::~SvxFrameShape() throw()
 {
 }
 
+OUString SvxFrameShape::GetAndClearInitialFrameURL()
+{
+    OUString sRet(m_sInitialFrameURL);
+    m_sInitialFrameURL.clear();
+    return sRet;
+}
+
 void SvxFrameShape::Create( SdrObject* pNewObj, SvxDrawPage* pNewPage )
 {
+    uno::Reference<beans::XPropertySet> xSet(static_cast<OWeakObject *>(this), 
uno::UNO_QUERY);
+    if (xSet)
+        xSet->getPropertyValue("FrameURL") >>= m_sInitialFrameURL;
+
     SvxShape::Create( pNewObj, pNewPage );
     const SvGlobalName aIFrameClassId( SO3_IFRAME_CLASSID );
     createObject(aIFrameClassId);
diff --git a/sw/inc/ndole.hxx b/sw/inc/ndole.hxx
index 21896f6f99c0..b996540e70b5 100644
--- a/sw/inc/ndole.hxx
+++ b/sw/inc/ndole.hxx
@@ -28,7 +28,7 @@ class SwGrfFormatColl;
 class SwDoc;
 class SwOLENode;
 class SwOLEListener_Impl;
-class SwEmbedObjectLink;
+namespace sfx2 { class SvBaseLink; }
 class DeflateData;
 
 class SW_DLLPUBLIC SwOLEObj
@@ -88,7 +88,7 @@ class SW_DLLPUBLIC SwOLENode: public SwNoTextNode
     bool   mbOLESizeInvalid; /**< Should be considered at SwDoc::PrtOLENotify
                                    (e.g. copied). Is not persistent. */
 
-    SwEmbedObjectLink*  mpObjectLink;
+    sfx2::SvBaseLink*  mpObjectLink;
     OUString maLinkURL;
 
     SwOLENode(  const SwNodeIndex &rWhere,
diff --git a/sw/source/core/ole/ndole.cxx b/sw/source/core/ole/ndole.cxx
index 4d2d5b05bce8..3a15ee2c0c13 100644
--- a/sw/source/core/ole/ndole.cxx
+++ b/sw/source/core/ole/ndole.cxx
@@ -146,6 +146,8 @@ void SAL_CALL SwOLEListener_Impl::disposing( const 
lang::EventObject& )
 // TODO/LATER: actually SwEmbedObjectLink should be used here, but because 
different objects are used to control
 //             embedded object different link objects with the same 
functionality had to be implemented
 
+namespace {
+
 class SwEmbedObjectLink : public sfx2::SvBaseLink
 {
     SwOLENode*          pOleNode;
@@ -208,6 +210,44 @@ void SwEmbedObjectLink::Closed()
     SvBaseLink::Closed();
 }
 
+class SwIFrameLink : public sfx2::SvBaseLink
+{
+    SwOLENode* m_pOleNode;
+
+public:
+    explicit SwIFrameLink(SwOLENode* pNode)
+        : ::sfx2::SvBaseLink(::SfxLinkUpdateMode::ONCALL, 
SotClipboardFormatId::SVXB)
+        , m_pOleNode(pNode)
+    {
+        SetSynchron( false );
+    }
+
+    ::sfx2::SvBaseLink::UpdateResult DataChanged(
+        const OUString&, const uno::Any& )
+    {
+        uno::Reference<embed::XEmbeddedObject> xObject = 
m_pOleNode->GetOLEObj().GetOleRef();
+        uno::Reference<embed::XCommonEmbedPersist> xPersObj(xObject, 
uno::UNO_QUERY);
+        if (xPersObj.is())
+        {
+            // let the IFrameObject reload the link
+            try
+            {
+                xPersObj->reload(uno::Sequence<beans::PropertyValue>(), 
uno::Sequence<beans::PropertyValue>());
+            }
+            catch (const uno::Exception&)
+            {
+            }
+
+            m_pOleNode->SetChanged();
+        }
+
+        return SUCCESS;
+    }
+
+};
+
+}
+
 SwOLENode::SwOLENode( const SwNodeIndex &rWhere,
                     const svt::EmbeddedObjectRef& xObj,
                     SwGrfFormatColl *pGrfColl,
@@ -589,28 +629,59 @@ void SwOLENode::DisconnectFileLink_Impl()
 
 void SwOLENode::CheckFileLink_Impl()
 {
-    if ( maOLEObj.m_xOLERef.GetObject().is() && !mpObjectLink )
+    if ( !(maOLEObj.m_xOLERef.GetObject().is() && !mpObjectLink) )
+        return;
+
+    try
     {
-        try
+        uno::Reference<embed::XEmbeddedObject> xObject = 
maOLEObj.m_xOLERef.GetObject();
+        if (!xObject)
+            return;
+
+        bool bIFrame = false;
+
+        OUString aLinkURL;
+        uno::Reference<embed::XLinkageSupport> xLinkSupport(xObject, 
uno::UNO_QUERY);
+        if (xLinkSupport)
+        {
+            if (xLinkSupport->isLink())
+                aLinkURL = xLinkSupport->getLinkURL();
+        }
+        else
         {
-            uno::Reference< embed::XLinkageSupport > xLinkSupport( 
maOLEObj.m_xOLERef.GetObject(), uno::UNO_QUERY_THROW );
-            if ( xLinkSupport->isLink() )
+            // get IFrame (Floating Frames) listed and updatable from the
+            // manage links dialog
+            SvGlobalName aClassId(xObject->getClassID());
+            if (aClassId == SvGlobalName(SO3_IFRAME_CLASSID))
             {
-                const OUString aLinkURL = xLinkSupport->getLinkURL();
-                if ( !aLinkURL.isEmpty() )
-                {
-                    // this is a file link so the model link manager should 
handle it
-                    mpObjectLink = new SwEmbedObjectLink( this );
-                    maLinkURL = aLinkURL;
-                    
GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( 
*mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
-                    mpObjectLink->Connect();
-                }
+                uno::Reference<beans::XPropertySet> 
xSet(xObject->getComponent(), uno::UNO_QUERY);
+                if (xSet.is())
+                    xSet->getPropertyValue("FrameURL") >>= aLinkURL;
+                bIFrame = true;
             }
         }
-        catch( uno::Exception& )
+
+        if (!aLinkURL.isEmpty()) // this is a file link so the model link 
manager should handle it
         {
+            SwEmbedObjectLink* pEmbedObjectLink = nullptr;
+            if (!bIFrame)
+            {
+                pEmbedObjectLink = new SwEmbedObjectLink(this);
+                mpObjectLink = pEmbedObjectLink;
+            }
+            else
+            {
+                mpObjectLink = new SwIFrameLink(this);
+            }
+            maLinkURL = aLinkURL;
+            
GetDoc()->getIDocumentLinksAdministration().GetLinkManager().InsertFileLink( 
*mpObjectLink, OBJECT_CLIENT_OLE, aLinkURL );
+            if (pEmbedObjectLink)
+                pEmbedObjectLink->Connect();
         }
     }
+    catch( uno::Exception& )
+    {
+    }
 }
 
 // #i99665#
diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
index 508003297f1e..8c99e834ce50 100644
--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
@@ -3224,9 +3224,35 @@ 
SdXMLFloatingFrameShapeContext::~SdXMLFloatingFrameShapeContext()
 {
 }
 
+uno::Reference<drawing::XShape> 
SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape() const
+{
+    uno::Reference<lang::XMultiServiceFactory> 
xServiceFact(GetImport().GetModel(), uno::UNO_QUERY);
+    if (!xServiceFact.is())
+        return nullptr;
+    uno::Reference<drawing::XShape> xShape(
+            xServiceFact->createInstance("com.sun.star.drawing.FrameShape"), 
uno::UNO_QUERY);
+    return xShape;
+}
+
 void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< 
css::xml::sax::XAttributeList >& )
 {
-    AddShape("com.sun.star.drawing.FrameShape");
+    uno::Reference<drawing::XShape> 
xShape(SdXMLFloatingFrameShapeContext::CreateFloatingFrameShape());
+
+    uno::Reference< beans::XPropertySet > xProps(xShape, uno::UNO_QUERY);
+    // set FrameURL before AddShape, we have to do it again later because it
+    // gets cleared when the SdrOle2Obj is attached to the XShape.  But we want
+    // FrameURL to exist when AddShape triggers SetPersistName which itself
+    // triggers SdrOle2Obj::CheckFileLink_Impl and at that point we want to
+    // know what URL will end up being used. So bodge this by setting FrameURL
+    // to the temp pre-SdrOle2Obj attached properties and we can smuggle it
+    // eventually into SdrOle2Obj::SetPersistName at the right point after
+    // PersistName is set but before SdrOle2Obj::CheckFileLink_Impl is called
+    // in order to inform the link manager that this is an IFrame that links to
+    // a URL
+    if (xProps && !maHref.isEmpty())
+        xProps->setPropertyValue("FrameURL", Any(maHref));
+
+    AddShape(xShape);
 
     if( mxShape.is() )
     {
@@ -3235,7 +3261,6 @@ void SdXMLFloatingFrameShapeContext::StartElement( const 
css::uno::Reference< cs
         // set pos, size, shear and rotate
         SetTransformation();
 
-        uno::Reference< beans::XPropertySet > xProps( mxShape, uno::UNO_QUERY 
);
         if( xProps.is() )
         {
             if( !maFrameName.isEmpty() )
diff --git a/xmloff/source/draw/ximpshap.hxx b/xmloff/source/draw/ximpshap.hxx
index c1e34a138093..a82bebbc42f3 100644
--- a/xmloff/source/draw/ximpshap.hxx
+++ b/xmloff/source/draw/ximpshap.hxx
@@ -517,6 +517,8 @@ private:
     OUString maFrameName;
     OUString maHref;
 
+    css::uno::Reference<css::drawing::XShape> CreateFloatingFrameShape() const;
+
 public:
 
     SdXMLFloatingFrameShapeContext( SvXMLImport& rImport, sal_uInt16 nPrfx,
commit 7594df6b4edf3a533dd4a14095dabde69452f67c
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Apr 11 10:13:37 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:42:58 2023 +0200

    set Referer on loading IFrames
    
    so tools, options, security, options,
    "block any links from document not..."
    applies to their contents.
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150221
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150751
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit acff9ca0579333b45d10ae5f8cd48172f563dddd)
    
    Change-Id: I04839aea6b07a4a76ac147a85045939ccd9c3c79

diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
index f0fcfbe64dc2..c1092ed3d1cd 100644
--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
@@ -38,6 +38,7 @@
 #include <svtools/miscopt.hxx>
 #include <svl/ownlist.hxx>
 #include <svl/itemprop.hxx>
+#include <sfx2/docfile.hxx>
 #include <sfx2/frmdescr.hxx>
 #include <sfx2/objsh.hxx>
 #include <sfx2/sfxdlg.hxx>
@@ -166,14 +167,19 @@ sal_Bool SAL_CALL IFrameObject::load(
         uno::Reference < util::XURLTransformer > xTrans( 
util::URLTransformer::create( mxContext ) );
         xTrans->parseStrict( aTargetURL );
 
+        uno::Reference<frame::XFramesSupplier> xParentFrame = 
xFrame->getCreator();
+        SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
+
         if (INetURLObject(aTargetURL.Complete).GetProtocol() == 
INetProtocol::Macro)
         {
-            uno::Reference<frame::XFramesSupplier> xParentFrame = 
xFrame->getCreator();
-            SfxObjectShell* pDoc = 
SfxMacroLoader::GetObjectShell(xParentFrame);
             if (pDoc && !pDoc->AdjustMacroMode())
                 return false;
         }
 
+        OUString sReferer;
+        if (pDoc && pDoc->HasName())
+            sReferer = pDoc->GetMedium()->GetName();
+
         DBG_ASSERT( !mxFrame.is(), "Frame already existing!" );
         VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( 
xFrame->getContainerWindow() );
         VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( 
pParent, maFrmDescr.IsFrameBorderOn() );
@@ -196,11 +202,13 @@ sal_Bool SAL_CALL IFrameObject::load(
         if ( xFramesSupplier.is() )
             mxFrame->setCreator( xFramesSupplier );
 
-        uno::Sequence < beans::PropertyValue > aProps(2);
+        uno::Sequence < beans::PropertyValue > aProps(3);
         aProps[0].Name = "PluginMode";
         aProps[0].Value <<= sal_Int16(2);
         aProps[1].Name = "ReadOnly";
         aProps[1].Value <<= true;
+        aProps[2].Name = "Referer";
+        aProps[2].Value <<= sReferer;
         uno::Reference < frame::XDispatch > xDisp = mxFrame->queryDispatch( 
aTargetURL, "_self", 0 );
         if ( xDisp.is() )
             xDisp->dispatch( aTargetURL, aProps );
commit 8cbe13e0397c04afb384956fef7c41671b3fc3c1
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Tue Apr 18 11:23:39 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:38:39 2023 +0200

    libxml2: upgrade to release 2.10.4
    
    Fixes CVE-2023-29469 and CVE-2023-28484.
    
    Also: SAX2: Ignore namespaces in HTML documents
    
    which is probably the reason why one test fails, so switch it to parsing
    XML:
    
        HTML parser error : Tag reqif-xhtml:div invalid
        <reqif-xhtml:div>
        HTML parser error : Tag reqif-xhtml:table invalid
        <reqif-xhtml:table cellpadding="2" cellspacing="2">
        ...
        reqif-table.xhtml:
        
C:/cygwin/home/tdf/jenkins/workspace/gerrit_windows/test/source/xmltesttools.cxx:195:testReqIfTable::Import_Export
        equality assertion failed
        - Expected: 1
        - Actual  : 0
        - In 
<file:///C:/cygwin/home/tdf/jenkins/workspace/gerrit_windows/tempdir/lu134607bxu8q.tmp>,
 XPath '/html/body/div/table/tr/th' number of nodes is incorrect
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150544
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit b28fd940ca46828be624679863364b4db89dd38c)
    
    Change-Id: Icc161b39515c996193366bc777a67eca79e4e892

diff --git a/download.lst b/download.lst
index 32c79fd93f13..eefa1af5f4ed 100644
--- a/download.lst
+++ b/download.lst
@@ -156,8 +156,8 @@ export LIBTOMMATH_SHA256SUM := 
083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304
 export LIBTOMMATH_TARBALL := ltm-1.0.zip
 export XMLSEC_SHA256SUM := 
13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4
 export XMLSEC_TARBALL := xmlsec1-1.2.28.tar.gz
-export LIBXML_SHA256SUM := 
5d2cc3d78bec3dbe212a9d7fa629ada25a7da928af432c93060ff5c17ee28a9c
-export LIBXML_VERSION_MICRO := 3
+export LIBXML_SHA256SUM := 
ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45
+export LIBXML_VERSION_MICRO := 4
 export LIBXML_TARBALL := libxml2-2.10.$(LIBXML_VERSION_MICRO).tar.xz
 export LIBXSLT_SHA256SUM := 
8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79
 export LIBXSLT_VERSION_MICRO := 35
diff --git a/sw/qa/extras/htmlexport/htmlexport.cxx 
b/sw/qa/extras/htmlexport/htmlexport.cxx
index 842289f1dd44..3eee4c223890 100644
--- a/sw/qa/extras/htmlexport/htmlexport.cxx
+++ b/sw/qa/extras/htmlexport/htmlexport.cxx
@@ -488,17 +488,25 @@ DECLARE_HTMLEXPORT_TEST(testReqIfJpgImg, 
"reqif-jpg-img.xhtml")
 
 DECLARE_HTMLEXPORT_TEST(testReqIfTable, "reqif-table.xhtml")
 {
-    htmlDocPtr pDoc = parseHtml(maTempFile);
+    SvMemoryStream aStream;
+    HtmlExportTest::wrapFragment(maTempFile, aStream);
+    xmlDocPtr pDoc = parseXmlStream(&aStream);
     CPPUNIT_ASSERT(pDoc);
 
     // <div> was missing, so the XHTML fragment wasn't a valid
     // xhtml.BlkStruct.class type anymore.
-    assertXPath(pDoc, "/html/body/div/table/tr/th", 1);
+    assertXPath(pDoc,
+                
"/reqif-xhtml:html/reqif-xhtml:div/reqif-xhtml:table/reqif-xhtml:tr/reqif-xhtml:th",
+                1);
     // The attribute was present to contain "background" and "border", which is
     // ignored in reqif-xhtml.
-    assertXPathNoAttribute(pDoc, "/html/body/div/table/tr/th", "style");
+    assertXPathNoAttribute(
+        pDoc, 
"/reqif-xhtml:html/reqif-xhtml:div/reqif-xhtml:table/reqif-xhtml:tr/reqif-xhtml:th",
+        "style");
     // The attribute was present, which is not valid in reqif-xhtml.
-    assertXPathNoAttribute(pDoc, "/html/body/div/table/tr/th", "bgcolor");
+    assertXPathNoAttribute(
+        pDoc, 
"/reqif-xhtml:html/reqif-xhtml:div/reqif-xhtml:table/reqif-xhtml:tr/reqif-xhtml:th",
+        "bgcolor");
 }
 
 DECLARE_HTMLEXPORT_TEST(testReqIfTable2, "reqif-table2.odt")
commit ab47749543b190eb942a54b4f33f67d7333366b6
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Mon Mar 20 11:52:22 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:37:03 2023 +0200

    curl: upgrade to release 8.0.0
    
    Fixes CVE-2023-27535.
    
    Also hopefully fixes excessive storage consumption during build:
    o build: drop the use of XC_AMEND_DISTCLEAN [62]
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149153
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit bbe0d0534abe6480c4502ce8fb543a736d3399d8)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149105
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 38b54a4d86e05bbbbdbf2a38771395579d1b005a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149108
    Tested-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 383128f262ea7fef7b6e372dc364a32d6cb0a7da)
    
    curl: upgrade to release 8.0.1
    
    Apparently 8.0.0 had a serious regression.
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149204
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit e5005c76bd60a004f6025728e794ba3e4d0dfff1)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149112
    Tested-by: László Németh <nem...@numbertext.org>
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit f2d935242665774f080bb13a2814988ad615f6e1)
    
    Change-Id: Icc761f5e5e01b5d9bebecc13f7cba608f5834f54

diff --git a/download.lst b/download.lst
index 2f482a7a832b..32c79fd93f13 100644
--- a/download.lst
+++ b/download.lst
@@ -29,8 +29,8 @@ export CPPUNIT_SHA256SUM := 
3d569869d27b48860210c758c4f313082103a5e58219a7669b52
 export CPPUNIT_TARBALL := cppunit-1.14.0.tar.gz
 export CT2N_SHA256SUM := 
71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 
1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 
1dae31b2a7c1fe269de99c0c31bb488346aab3459b5ffca909d6938249ae415f
-export CURL_TARBALL := curl-7.88.1.tar.xz
+export CURL_SHA256SUM := 
0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0
+export CURL_TARBALL := curl-8.0.1.tar.xz
 export EBOOK_SHA256SUM := 
7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 
002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d
commit f0317ef1da761bc39d490031406cf982f4270b9a
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Fri Feb 24 17:49:23 2023 +0900
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:33:40 2023 +0200

    postgresql: upgrade to release 13.10
    
    Fixes CVE-2022-41862
    
    Reference: https://www.postgresql.org/support/security/CVE-2022-41862/
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147834
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit efff34d7bdccf210a5e878bd9bc4d35ec72b71ab)
    
    Change-Id: I6075838972fec1c091f3150b19c5da4dc80ad6d3

diff --git a/download.lst b/download.lst
index 9f6d0cb97f94..2f482a7a832b 100644
--- a/download.lst
+++ b/download.lst
@@ -208,8 +208,8 @@ export LIBPNG_SHA256SUM := 
505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201f
 export LIBPNG_TARBALL := libpng-1.6.37.tar.xz
 export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
 export POPPLER_TARBALL := poppler-22.09.0.tar.xz
-export POSTGRESQL_SHA256SUM := 
9b81067a55edbaabc418aacef457dd8477642827499560b00615a6ea6c13f6b3
-export POSTGRESQL_TARBALL := postgresql-13.5.tar.bz2
+export POSTGRESQL_SHA256SUM := 
5bbcf5a56d85c44f3a8b058fb46862ff49cbc91834d07e295d02e6de3c216df2
+export POSTGRESQL_TARBALL := postgresql-13.10.tar.bz2
 export PYTHON_SHA256SUM := 
c24a37c63a67f53bdd09c5f287b5cff8e8b98f857bf348c577d454d3f74db049
 export PYTHON_TARBALL := Python-3.5.9.tar.xz
 export QXP_SHA256SUM := 
e137b6b110120a52c98edd02ebdc4095ee08d0d5295a94316a981750095a945c
commit dd7312c39f42d38800012e848fd48b52fb133ee0
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Thu Feb 23 15:31:02 2023 +0900
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:32:40 2023 +0200

    curl: upgrade to release 7.88.1
    
    Fixes CVE-2023-23916, 2 CVEs that probably don't affect LO.
    
    Reference: https://curl.se/docs/security.html
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147977
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 6074d16b8c631e679a67364837d4ca9799731152)
    
    Change-Id: If9b3fc7c5ce66bfe1027caff39ea2c1cf55df7ad

diff --git a/download.lst b/download.lst
index 7145946d6d6c..9f6d0cb97f94 100644
--- a/download.lst
+++ b/download.lst
@@ -29,8 +29,8 @@ export CPPUNIT_SHA256SUM := 
3d569869d27b48860210c758c4f313082103a5e58219a7669b52
 export CPPUNIT_TARBALL := cppunit-1.14.0.tar.gz
 export CT2N_SHA256SUM := 
71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 
1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 
ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff
-export CURL_TARBALL := curl-7.87.0.tar.xz
+export CURL_SHA256SUM := 
1dae31b2a7c1fe269de99c0c31bb488346aab3459b5ffca909d6938249ae415f
+export CURL_TARBALL := curl-7.88.1.tar.xz
 export EBOOK_SHA256SUM := 
7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 
002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d
diff --git a/external/curl/curl-7.26.0_win-proxy.patch 
b/external/curl/curl-7.26.0_win-proxy.patch
index 909ca38315a6..62016a70e8a0 100644
--- a/external/curl/curl-7.26.0_win-proxy.patch
+++ b/external/curl/curl-7.26.0_win-proxy.patch
@@ -44,7 +44,7 @@
  /****************************************************************
  * Detect what (if any) proxy to use. Remember that this selects a host
  * name and is not limited to HTTP proxies only.
-@@ -4613,6 +4633,66 @@
+@@ -4613,6 +4633,67 @@
     * For compatibility, the all-uppercase versions of these variables are
     * checked if the lowercase versions don't exist.
     */
@@ -58,6 +58,7 @@
 +      char *ieProxy;
 +      char *ieNoProxy;
 +      char *pos;
++      bool spacesp;
 +
 +      ieProxy = wstrToCstr(ieProxyConfig->lpszProxy);
 +      ieNoProxy = wstrToCstr(ieProxyConfig->lpszProxyBypass);
@@ -72,7 +73,7 @@
 +        }
 +      }
 +
-+      if(!Curl_check_noproxy(conn->host.name, no_proxy)) {
++      if(!Curl_check_noproxy(conn->host.name, no_proxy, &spacesp)) {
 +        /* Look for the http proxy setting */
 +        char *tok;
 +        char *saveptr;
diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1
index 2128849369e7..2e8766b3d45f 100644
--- a/external/curl/curl-nss.patch.1
+++ b/external/curl/curl-nss.patch.1
@@ -1,7 +1,7 @@
 diff -ur curl.org/configure curl/configure
---- curl.org/configure 2016-03-13 15:14:07.177000076 +0100
-+++ curl/configure     2016-03-13 15:16:44.132000076 +0100
-@@ -28230,7 +28230,12 @@
+--- curl.orig/configure        2023-02-20 16:11:55.000000000 +0900
++++ curl/configure     2023-02-23 15:40:58.617432471 +0900
+@@ -28675,7 +28675,12 @@
        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired 
libraries and compilation flags for NSS." >&5
  printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation 
flags for NSS." >&2;}
        addld="-L$OPT_NSS/lib"
commit 7da780b895b835b1d5103df1a585148ccb0926f9
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Fri Dec 30 21:29:58 2022 +0900
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:31:06 2023 +0200

    curl: upgrade to release 7.87.0
    
    Fixes CVE-2022-43551 and CVE-2022-43552.
    
    https://curl.se/docs/CVE-2022-43551.html
    https://curl.se/docs/CVE-2022-43552.html
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 181806115a694ade32c7bba1abd9aa931b1a93b9)
    
    Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5

diff --git a/download.lst b/download.lst
index 9eab8af439f3..7145946d6d6c 100644
--- a/download.lst
+++ b/download.lst
@@ -29,8 +29,8 @@ export CPPUNIT_SHA256SUM := 
3d569869d27b48860210c758c4f313082103a5e58219a7669b52
 export CPPUNIT_TARBALL := cppunit-1.14.0.tar.gz
 export CT2N_SHA256SUM := 
71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 
1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 
2d61116e5f485581f6d59865377df4463f2e788677ac43222b496d4e49fb627b
-export CURL_TARBALL := curl-7.86.0.tar.xz
+export CURL_SHA256SUM := 
ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff
+export CURL_TARBALL := curl-7.87.0.tar.xz
 export EBOOK_SHA256SUM := 
7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 
002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d
diff --git a/external/curl/curl-7.26.0_win-proxy.patch 
b/external/curl/curl-7.26.0_win-proxy.patch
index 6fb20533e097..909ca38315a6 100644
--- a/external/curl/curl-7.26.0_win-proxy.patch
+++ b/external/curl/curl-7.26.0_win-proxy.patch
@@ -12,8 +12,8 @@
 --- curl-7.26.0/lib/url.c
 +++ misc/build/curl-7.26.0/lib/url.c
 @@ -78,6 +78,10 @@
- bool Curl_win32_idn_to_ascii(const char *in, char **out);
- #endif  /* USE_LIBIDN2 */
+ 
+ #include <limits.h>
  
 +#ifdef _WIN32
 +#include <WinHttp.h>
diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 
b/external/curl/curl-msvc-disable-protocols.patch.1
index 89c4ff576f85..71ff0c01a028 100644
--- a/external/curl/curl-msvc-disable-protocols.patch.1
+++ b/external/curl/curl-msvc-disable-protocols.patch.1
@@ -2,7 +2,7 @@ disable protocols nobody needs in MSVC build
 
 --- curl/lib/config-win32.h.orig       2017-08-09 16:43:29.464000000 +0200
 +++ curl/lib/config-win32.h    2017-08-09 16:47:38.549200000 +0200
-@@ -616,4 +616,20 @@
+@@ -654,4 +654,20 @@
  #  define ENABLE_IPV6 1
  #endif
  
diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1
index 5ef25748d7eb..2128849369e7 100644
--- a/external/curl/curl-nss.patch.1
+++ b/external/curl/curl-nss.patch.1
@@ -1,7 +1,7 @@
 diff -ur curl.org/configure curl/configure
 --- curl.org/configure 2016-03-13 15:14:07.177000076 +0100
 +++ curl/configure     2016-03-13 15:16:44.132000076 +0100
-@@ -27985,7 +27985,12 @@
+@@ -28230,7 +28230,12 @@
        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired 
libraries and compilation flags for NSS." >&5
  printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation 
flags for NSS." >&2;}
        addld="-L$OPT_NSS/lib"
diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0
index b8e242a3aaea..b4442ba262d1 100644
--- a/external/curl/zlib.patch.0
+++ b/external/curl/zlib.patch.0
@@ -1,6 +1,6 @@
 --- configure
 +++ configure
-@@ -22808,7 +22808,6 @@
+@@ -23035,7 +23035,6 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -8,7 +8,7 @@
  
  # Check whether --with-zlib was given.
  if test ${with_zlib+y}
-@@ -22818,6 +22818,7 @@
+@@ -23045,6 +23044,7 @@
  
  
  if test "$OPT_ZLIB" = "no" ; then
@@ -16,7 +16,7 @@
      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
  printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
  else
-@@ -22825,6 +825,21 @@
+@@ -23052,6 +23052,21 @@
      OPT_ZLIB=""
    fi
  
@@ -38,7 +38,7 @@
    if test -z "$OPT_ZLIB" ; then
  
      if test -n "$PKG_CONFIG"; then
-@@ -23120,6 +23120,7 @@
+@@ -23344,6 +23359,7 @@
  printf "%s\n" "$as_me: found both libz and libz.h header" >&6;}
      curl_zlib_msg="enabled"
    fi
@@ -48,7 +48,7 @@
   if test x"$AMFIXLIB" = x1; then
 --- configure.ac
 +++ configure.ac
-@@ -1222,19 +1222,30 @@
+@@ -1243,19 +1243,30 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -80,7 +80,7 @@
    if test -z "$OPT_ZLIB" ; then
      CURL_CHECK_PKGCONFIG(zlib)
  
-@@ -1316,6 +1316,7 @@
+@@ -1336,6 +1347,7 @@
      AC_MSG_NOTICE([found both libz and libz.h header])
      curl_zlib_msg="enabled"
    fi
commit c2fbd154c70f9918cafdf42b14bda45315f45c71
Author:     Thorsten Behrens <thorsten.behr...@allotropia.de>
AuthorDate: Sun May 14 23:06:36 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 23:06:36 2023 +0200

    nss: upgrade to release 3.88.1
    
    Fixes CVE-2023-0767 CVE-2022-3479
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147387
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 538975a0e511ad79a7dd3c71300b993d1554cd03)
    
    Change-Id: I688dc7d0785ed3344c33e331c7e9ef37baa720ee

diff --git a/download.lst b/download.lst
index 319a9e335655..9eab8af439f3 100644
--- a/download.lst
+++ b/download.lst
@@ -181,8 +181,8 @@ export MYTHES_SHA256SUM := 
1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_SHA256SUM := 
db0bd8cdec329b48f53a6f00199c92d5ba40b0f015b153718d1b15d3d967fbca
 export NEON_TARBALL := neon-0.30.2.tar.gz
-export NSS_SHA256SUM := 
5369ed274a19f480ec94e1faef04da63e3cbac1a82e15bb1751e58b2f274b835
-export NSS_TARBALL := nss-3.79-with-nspr-4.34.tar.gz
+export NSS_SHA256SUM := 
fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a
+export NSS_TARBALL := nss-3.88.1-with-nspr-4.35.tar.gz
 export ODFGEN_SHA256SUM := 
2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2
 export ODFGEN_VERSION_MICRO := 6
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2
commit 647708971f0ed1a6a6cc18754d336bd0fea34a03
Author:     Eike Rathke <er...@redhat.com>
AuthorDate: Thu Feb 16 20:20:31 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:50:31 2023 +0200

    Obtain actual 0-parameter count for OR(), AND() and 1-parameter functions
    
    OR and AND for legacy infix notation are classified as binary
    operators but in fact are functions with parameter count. In case
    no argument is supplied, GetByte() returns 0 and for that case the
    implicit binary operator 2 parameters were wrongly assumed.
    Similar for functions expecting 1 parameter, without argument 1
    was assumed. For "real" unary and binary operators the compiler
    already checks parameters. Omit OR and AND and 1-parameter
    functions from this implicit assumption and return the actual 0
    count.
    
    Change-Id: Ie05398c112a98021ac2875cf7b6de994aee9d882
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147173
    Reviewed-by: Eike Rathke <er...@redhat.com>
    Tested-by: Jenkins
    (cherry picked from commit e7ce9bddadb2db222eaa5f594ef1de2e36d57e5c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147129
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit d6599a2af131994487d2d9223a4fd32a8c3ddc49)

diff --git a/formula/source/core/api/token.cxx 
b/formula/source/core/api/token.cxx
index 8069863ca503..f45be812e734 100644
--- a/formula/source/core/api/token.cxx
+++ b/formula/source/core/api/token.cxx
@@ -95,17 +95,14 @@ sal_uInt8 FormulaToken::GetParamCount() const
         return 0;       // parameters and specials
                         // ocIf... jump commands not for FAP, have cByte then
 //2do: bool parameter whether FAP or not?
-    else if ( GetByte() )
+    else if (GetByte())
         return GetByte();   // all functions, also ocExternal and ocMacro
-    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP)
-        return 2;           // binary
-    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP)
-            || eOp == ocPercentSign)
-        return 1;           // unary
+    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP && 
eOp != ocAnd && eOp != ocOr)
+        return 2;           // binary operators, compiler checked; OR and AND 
legacy but are functions
+    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP) || 
eOp == ocPercentSign)
+        return 1;           // unary operators, compiler checked
     else if (SC_OPCODE_START_NO_PAR <= eOp && eOp < SC_OPCODE_STOP_NO_PAR)
         return 0;           // no parameter
-    else if (SC_OPCODE_START_1_PAR <= eOp && eOp < SC_OPCODE_STOP_1_PAR)
-        return 1;           // one parameter
     else if (FormulaCompiler::IsOpCodeJumpCommand( eOp ))
         return 1;           // only the condition counts as parameter
     else
diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
index bb6583a2c460..e5cfbcb02b09 100644
--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
@@ -3985,7 +3985,15 @@ StackVar ScInterpreter::Interpret()
                 else if (sp >= pCur->GetParamCount())
                     nStackBase = sp - pCur->GetParamCount();
                 else
-                    nStackBase = sp;    // underflow?!?
+                {
+                    SAL_WARN("sc.core", "Stack anomaly at " << aPos.Format(
+                                ScRefFlags::VALID | ScRefFlags::FORCE_DOC | 
ScRefFlags::TAB_3D, pDok)
+                            << "  eOp: " << static_cast<int>(eOp)
+                            << "  params: " << 
static_cast<int>(pCur->GetParamCount())
+                            << "  nStackBase: " << nStackBase << "  sp: " << 
sp);
+                    nStackBase = sp;
+                    assert(!"underflow");
+                }
             }
 
             switch( eOp )
commit 8acd526c1fae9dd8a98cc315fd4b715e812bc383
Author:     Eike Rathke <er...@redhat.com>
AuthorDate: Mon Feb 27 16:10:06 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:48:54 2023 +0200

    Always push a result, even if it's only an error
    
    PERCENTILE() and QUARTILE() if an error was passed as argument (or
    an error encountered during obtaining arguments) omitted to push
    an error result, only setting the error.
    
    Fallout from
    
        commit f336f63da900d76c2bf6e5690f1c8a7bd15a0aa2
        CommitDate: Thu Mar 3 16:28:59 2016 +0000
    
            tdf#94635 Add FORECAST.ETS functions to Calc
    
    Change-Id: I23e276fb0ce735cfd6383cc963446499dcf819f4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147922
    Reviewed-by: Eike Rathke <er...@redhat.com>
    Tested-by: Jenkins
    (cherry picked from commit 64914560e279c71ff1233f4bab851e2a292797e6)

diff --git a/sc/source/core/tool/interpr3.cxx b/sc/source/core/tool/interpr3.cxx
index 414237b369b3..7596fec7c72d 100644
--- a/sc/source/core/tool/interpr3.cxx
+++ b/sc/source/core/tool/interpr3.cxx
@@ -3473,7 +3473,7 @@ void ScInterpreter::ScPercentile( bool bInclusive )
     GetNumberSequenceArray( 1, aArray, false );
     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
     {
-        SetError( FormulaError::NoValue );
+        PushNoValue();
         return;
     }
     if ( bInclusive )
@@ -3496,7 +3496,7 @@ void ScInterpreter::ScQuartile( bool bInclusive )
     GetNumberSequenceArray( 1, aArray, false );
     if ( aArray.empty() || nGlobalError != FormulaError::NONE )
     {
-        SetError( FormulaError::NoValue );
+        PushNoValue();
         return;
     }
     if ( bInclusive )
commit 685810208de1004fdc766c55f074644341cecc73
Author:     Eike Rathke <er...@redhat.com>
AuthorDate: Fri Feb 17 12:03:54 2023 +0100
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:48:32 2023 +0200

    Stack check safety belt before fishing in muddy waters
    
    Have it hit hard in debug builds.
    
    Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
    Reviewed-by: Eike Rathke <er...@redhat.com>
    Tested-by: Jenkins
    (cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147245
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 166a07062dd4ffedca6106f439a6fcddaeee5eb5)

diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
index 398fe707f86f..0840d599cbe1 100644
--- a/sc/source/core/inc/interpre.hxx
+++ b/sc/source/core/inc/interpre.hxx
@@ -235,6 +235,7 @@ private:
     inline bool MustHaveParamCount( short nAct, short nMust );
     inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
     inline bool MustHaveParamCountMin( short nAct, short nMin );
+    inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
     void PushParameterExpected();
     void PushIllegalParameter();
     void PushIllegalArgument();
@@ -1081,6 +1082,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short 
nAct, short nMin )
     return false;
 }
 
+inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, 
short nMin )
+{
+    assert(sp >= nAct);
+    if (sp < nAct)
+    {
+        PushParameterExpected();
+        return false;
+    }
+    return MustHaveParamCountMin( nAct, nMin);
+}
+
 inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
 {
     if (!rtl::math::isFinite( fVal))
diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index a624307dedd6..bdb83af166af 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -7522,7 +7522,7 @@ void ScInterpreter::ScVLookup()
 void ScInterpreter::ScSubTotal()
 {
     sal_uInt8 nParamCount = GetByte();
-    if ( MustHaveParamCountMin( nParamCount, 2 ) )
+    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
     {
         // We must fish the 1st parameter deep from the stack! And push it on 
top.
         const FormulaToken* p = pStack[ sp - nParamCount ];
@@ -7569,7 +7569,7 @@ void ScInterpreter::ScSubTotal()
 void ScInterpreter::ScAggregate()
 {
     sal_uInt8 nParamCount = GetByte();
-    if ( MustHaveParamCountMin( nParamCount, 3 ) )
+    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
     {
         // fish the 1st parameter from the stack and push it on top.
         const FormulaToken* p = pStack[ sp - nParamCount ];
commit e7c6f72fc5ad753be749939c4f50aef687a90604
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Feb 13 13:56:10 2023 +0000
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:46:23 2023 +0200

    disable script dump
    
    Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986
    Tested-by: Jenkins
    Reviewed-by: Thorsten Behrens <thorsten.behr...@allotropia.de>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051
    Tested-by: Thorsten Behrens <thorsten.behr...@allotropia.de>

diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx 
b/connectivity/source/drivers/hsqldb/HDriver.cxx
index c80826d4a79b..7922a020657d 100644
--- a/connectivity/source/drivers/hsqldb/HDriver.cxx
+++ b/connectivity/source/drivers/hsqldb/HDriver.cxx
@@ -299,6 +299,37 @@ namespace connectivity
                         } // if ( xStream.is() )
                         ::comphelper::disposeComponent(xStream);
                     }
+
+                    // disallow any database/script files that contain a 
"SCRIPT[.*]" entry (this is belt and braces
+                    // in that bundled hsqldb 1.8.0 is patched to also reject 
them)
+                    //
+                    // hsqldb 2.6.0 release notes have: added system role 
SCRIPT_OPS for export / import of database structure and data
+                    // which seems to provide a builtin way to do this with 
contemporary hsqldb
+                    const OUString sScript( "script" );
+                    if (!bIsNewDatabase && xStorage->isStreamElement(sScript))
+                    {
+                        Reference<XStream > xStream = 
xStorage->openStreamElement(sScript, ElementModes::READ);
+                        if (xStream.is())
+                        {
+                            std::unique_ptr<SvStream> 
pStream(::utl::UcbStreamHelper::CreateStream(xStream));
+                            if (pStream)
+                            {
+                                OString sLine;
+                                while (pStream->ReadLine(sLine))
+                                {
+                                    OString sText = sLine.trim();
+                                    if 
(sText.startsWithIgnoreAsciiCase("SCRIPT"))
+                                    {
+                                        ::connectivity::SharedResources 
aResources;
+                                        sMessage = 
aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$",
 sSystemPath);
+                                        break;
+                                    }
+                                }
+                            }
+                        } // if ( xStream.is() )
+                        ::comphelper::disposeComponent(xStream);
+                    }
+
                 }
                 catch(Exception&)
                 {
diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk 
b/external/hsqldb/UnpackedTarball_hsqldb.mk
index cbba770f19a0..ed262cccf4ca 100644
--- a/external/hsqldb/UnpackedTarball_hsqldb.mk
+++ b/external/hsqldb/UnpackedTarball_hsqldb.mk
@@ -29,6 +29,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\
                external/hsqldb/patches/jdbc-4.1.patch \
                external/hsqldb/patches/multipleResultSets.patch \
        ) \
+       external/hsqldb/patches/disable-dump-script.patch \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/hsqldb/patches/disable-dump-script.patch 
b/external/hsqldb/patches/disable-dump-script.patch
new file mode 100644
index 000000000000..401dd38abc9a
--- /dev/null
+++ b/external/hsqldb/patches/disable-dump-script.patch
@@ -0,0 +1,14 @@
+--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java    2023-02-13 
11:08:11.297243034 +0000
++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java    2023-02-13 
13:49:17.973089433 +0000
+@@ -403,6 +403,11 @@
+                     throw Trace.error(Trace.INVALID_IDENTIFIER);
+                 }
+ 
++                // added condition to avoid execution of spurious command in 
.script or .log file
++                if (session.isProcessingScript() || 
session.isProcessingLog()) {
++                    return new Result(ResultConstants.UPDATECOUNT);
++                }
++
+                 dsw = new ScriptWriterText(database, token, true, true, true);
+ 
+                 dsw.writeAll();
commit c4a0a15fbd14a02eb97a711aae3789b3426a1450
Author:     Thorsten Behrens <thorsten.behr...@allotropia.de>
AuthorDate: Sun May 14 22:38:44 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:38:44 2023 +0200

    openssl: upgrade to release 1.1.1t
    
    Fixes CVE-2023-0286 CVE-2023-0215 CVE-2022-4450 CVE-2022-4304
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146653
    Tested-by: Jenkins
    Reviewed-by: Thorsten Behrens <thorsten.behr...@allotropia.de>
    (cherry picked from commit f9229fdadbd205a8953577efc72a6e43717c764e)
    
    Change-Id: I93ce0362b17bd07b0644564a0676daaa56bc8b50

diff --git a/download.lst b/download.lst
index 246eedf56d0e..319a9e335655 100644
--- a/download.lst
+++ b/download.lst
@@ -192,8 +192,8 @@ export OFFICEOTRON_SHA256SUM := 
f2443f27561af52324eee03a1892d9f569adc8db9e7bca55
 export OFFICEOTRON_JAR := 
8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar
 export OPENLDAP_SHA256SUM := 
99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34
 export OPENLDAP_TARBALL := openldap-2.4.59.tgz
-export OPENSSL_SHA256SUM := 
e8be6a35fe41d10603c3cc635e93289ed00bf34b79671a3a4de64fcee00d5242
-export OPENSSL_TARBALL := openssl-1.1.1i.tar.gz
+export OPENSSL_SHA256SUM := 
8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b
+export OPENSSL_TARBALL := openssl-1.1.1t.tar.gz
 export ORCUS_SHA256SUM := 
3f48cfbc21ad74787218284939c04d42cb836c73bc393f27f538b668e4d78a5f
 export ORCUS_TARBALL := liborcus-0.14.1.tar.gz
 export OWNCLOUD_ANDROID_LIB_SHA256SUM := 
b18b3e3ef7fae6a79b62f2bb43cc47a5346b6330f6a383dc4be34439aca5e9fb
commit 1040351770a9992200706bf553db26d66c42613e
Author:     Thorsten Behrens <thorsten.behr...@allotropia.de>
AuthorDate: Sun May 14 22:08:51 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sun May 14 22:08:51 2023 +0200

    Release 6.3.6.22
    
    Change-Id: I5781f32d6fe85265e89c713a2bd40638bcc1ff29

diff --git a/configure.ac b/configure.ac
index a025e0ffce5d..e60a275d9c27 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
 # several non-alphanumeric characters, those are split off and used only for 
the
 # ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no 
idea.
 
-AC_INIT([LibreOffice],[6.3.6.21],[],[],[http://documentfoundation.org/])
+AC_INIT([LibreOffice],[6.3.6.22],[],[],[http://documentfoundation.org/])
 
 dnl libnumbertext needs autoconf 2.68, but that can pick up autoconf268 just 
fine if it is installed
 dnl whereas aclocal (as run by autogen.sh) insists on using autoconf and fails 
hard
commit 823ea949072a809aa26e227df7983c95af557248
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri May 12 17:45:45 2023 +0200
Commit:     Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Sat May 13 02:16:13 2023 +0200

    sw: layout: try not to MoveFwd onto a page created by page break
    
    There is a ToX that is updated; it has about 4 pages worth of entries.
    
    When the old entries are deleted, 2 of the pages become empty, and since
    commit b9ef71476fd70bc13f50ebe80390e0730d1b7afb these pages are deleted.
    
    While layouting the new entries, these are moved onto the page following
    the ToX, which starts with a page break and contains lots of footnotes.
    
    Now the footnotes reduce the space on the page available for the ToX
    entries, and thus after CalcLayout() there are 5 ToX pages instead of 4.
    
    Then the page numbers are inserted into the entries, and another layout
    action deletes one of the ToX pages; now all the page numbers are too
    large by 1.
    
    Some ideas to fix this:
    1) ignore a footnote when formatting a frame that is before the
       footnote anchor frame; similar to commit
       c79bf7865bff4e88cc201357370d8faeef8e6ad9
    2) invalidate the last content on the page when moving forward the
       footnote container, similar to commit
       eb85de8e6b61fb3fcb6c03ae0145f7fe5478bccf; this doesn't look easy to
       do because as it turns out the footnote container is moved in
       SwLayoutFrame::Cut() 5 function calls inside MoveFwd() while the frame
       on which MoveFwd() is called is still on the page, so would probably
       somehow need to be detected in MoveFwd() itself?
    3) don't move frames forward onto a page that was created by a page
       break - instead create a new frame.
    
    Let's try 3) for now, only in SwFrame::GetNextSctLeaf().
    
    (regression from commit b9ef71476fd70bc13f50ebe80390e0730d1b7afb)
    
    Change-Id: I641f586799a5ddb4e2a6ff8e9de784e422ecc214

diff --git a/sw/source/core/inc/frmtool.hxx b/sw/source/core/inc/frmtool.hxx
index 9e9c0c8f25a5..4f08992c04e8 100644
--- a/sw/source/core/inc/frmtool.hxx
+++ b/sw/source/core/inc/frmtool.hxx
@@ -152,6 +152,7 @@ long CalcHeightWithFlys( const SwFrame *pFrame );
 
 namespace sw {
 
+bool HasPageBreakBefore(SwPageFrame const& rPage);
 bool IsRightPageByNumber(SwRootFrame const& rLayout, sal_uInt16 nPageNum);
 
 } // namespace sw
diff --git a/sw/source/core/layout/flowfrm.cxx 
b/sw/source/core/layout/flowfrm.cxx
index c84bc17f9359..4d147d645d51 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -821,6 +821,26 @@ SwLayoutFrame *SwFrame::GetLeaf( MakePageType eMakePage, 
bool bFwd )
     return bFwd ? GetNextLeaf( eMakePage ) : GetPrevLeaf();
 }
 
+namespace sw {
+
+bool HasPageBreakBefore(SwPageFrame const& rPage)
+{
+    SwFrame const* pFlow(rPage.FindFirstBodyContent());
+    if (!pFlow)
+    {
+        return false;
+    }
+    while (pFlow->GetUpper()->IsInTab())
+    {
+        pFlow = pFlow->GetUpper()->FindTabFrame();
+    }
+    return pFlow->GetPageDescItem().GetPageDesc()
+        || pFlow->GetBreakItem().GetBreak() == SvxBreak::PageBefore
+        || pFlow->GetBreakItem().GetBreak() == SvxBreak::PageBoth;
+};
+
+} // namespace sw
+
 bool SwFrame::WrongPageDesc( SwPageFrame* pNew )
 {
     // Now it's getting a bit complicated:
diff --git a/sw/source/core/layout/sectfrm.cxx 
b/sw/source/core/layout/sectfrm.cxx
index 58d0c7d4d5ad..4a34d748a46e 100644
--- a/sw/source/core/layout/sectfrm.cxx
+++ b/sw/source/core/layout/sectfrm.cxx
@@ -1723,7 +1723,8 @@ SwLayoutFrame *SwFrame::GetNextSctLeaf( MakePageType 
eMakePage )
             // case pLayLeaf points to our section's cell's follow, which is
             // fine to be on the same page. New page creation is handled when
             // creating / moving the cell frame.
-            if( WrongPageDesc( pNxtPg ) && !bLayLeafTableAllowed )
+            // It doesn't make sense to move to a page that starts with break?
+            if ((WrongPageDesc(pNxtPg) || HasPageBreakBefore(*pNxtPg)) && 
!bLayLeafTableAllowed )
             {
                 if( bWrongPage )
                     break; // there's a column between me and my right page

Reply via email to