Merge remote-tracking branch 'upstream/4.13' into mb-testing

cura_app.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright (c) 2020 Ultimaker B.V.
+# Copyright (c) 2022 Ultimaker B.V.
 # Cura is released under the terms of the LGPLv3 or higher.
 
 # Remove the working directory from sys.path.
@@ -17,6 +17,9 @@
 import argparse
 import faulthandler
 import os
+if sys.platform != "linux":  # Turns out the Linux build _does_ use this, but we're not making an Enterprise release for that system anyway.
+    os.environ["QT_PLUGIN_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
+    os.environ["QML2_IMPORT_PATH"] = ""  # Security workaround: Don't need it, and introduces an attack vector, so set to nul.
 
 # Workaround for a race condition on certain systems where there
 # is a race condition between Arcus and PyQt. Importing Arcus

resources/texts/change_log.txt

@@ -1,4 +1,4 @@
-[4.13]
+[4.13.0]
 <i>For an overview of the new features in Cura 4.13, please watch <a href="https://youtu.be/chvAuI6Eqto">our video</a>.</i>
 
 * Sync material profiles 
@@ -56,6 +56,7 @@ We’ve streamlined the user login authentication by removing any restrictions,
 - Fixed a bug where support blockers were included in the bounding box after loading a project file
 - Fixed a bug where grouped models become unslicable if the first extruder was disabled
 - Fixed a bug in Tree Support where the Z Distance was too big
+- Prevented QT plug-ins from being loaded from an insecure directory if an environment variable is set
 
 * Printer definitions, profiles and materials:
 - Add Eazao Zero printer definition, contributed by Hogan-Polaris