Skip to content

UXL Launcher Version 3.3.1 Stable

Compare
Choose a tag to compare
@DrewNaylor DrewNaylor released this 06 Oct 05:10

UXL Launcher Version 3.3.1 Stable Changelog

Released on 10/6/2020 (MM/DD/YYYY).

While working on version 3.4, I found a potential security vulnerability, so I backported the fix to 3.3.1 so it's in a stable version right away rather than waiting two weeks.

Copied from version 3.4 RC1 changelog:
This version fixes a security vulnerability where the officeDriveLocation could be set to something like https://google.com/search?q=, which would result in the user being sent to a Google search for whatever app they clicked on, or worse. This is now fixed, and I highly recommend updating to this version. It should be safe to update to the release candidate version as there shouldn't be too many changes between now and the final. There will be a 3.3.1 update published for those who want a stable version with this fix. While most people probably wouldn't run into that issue, it's still something that needs to be solved as the config file the app ships with could be modified too; it's not just the one in LocalAppData that's a concern.

A few hours after this was published, I re-compiled the installer so it's quieter on startup.

Please be sure to read the Readme included with this version of UXL Launcher or online as it has important info. Also refer to the System Requirements.

If you're reading this in Notepad or another text editor, it displays best in Word Wrap view. Click on Format>Word Wrap on the top bar. Notepad++ users will find it under View>Word Wrap. Word Wrap is automatically done if viewing on GitHub or on the website.

Hashes

You can use Windows PowerShell to confirm the hash of the main UXL Launcher EXE file by running
Get-FileHash .\UXL-Launcher.exe -Algorithm SHA256 in the folder you extracted the archive to and comparing the output to my sum listed below. HowToGeek has a nice article on this, but the Windows section is a bit further down on the page.

7-Zip also has a way to check file hashes in the CRC SHA dropdown in the file context menu. This project is not associated with 7-Zip.

To check the installer's hash, run Get-FileHash .\UXL-Launcher_v3.3.1-Stable.exe -Algorithm SHA256 in Windows PowerShell. Other files will have to have the filename switched out.

SHA-256 sum for "UXL-Launcher.exe" in the archive:
B415C20481821F471A2DDF8213A44DA0A5EE59B6F8BA962D1A17EAE2D5054319

SHA-256 sum for "UXL-Launcher.exe.config" in the archive:
74651B2402720557FC483136D5DF5C8FDF5D48AD5B720B2AA7F0AFA427FB92F9

SHA-256 sum for "UXL-Launcher_v3.3.1-Stable.exe" (the installer attached to this release):
AB5EBD4CE1FD3DC20E1F2069C5CCFC3BA44DF5495ADEAA9599D039C46515274D

Fixed

  • Security vulnerability: It used to be possible to change My.Settings.officeDriveLocation to something like https://google.com/search?q=, which would take users to a Google search. This has been fixed by checking the length of the setting, and if it's not equal to 1, changing it back to C before using it on startup.

Deprecation/future change notices

  • A future version will change the default Office version in the Options window to Office 2019 due to Office 2010 support ending in October 2020.
  • Version 3.4 will have the Drive location and Bypass configured location options switch tabs. A link label has been added to the Options window to let the user know about this. (issue #180)
  • TE1.x/UXL Launcher Theme Engine will be deprecated sometime after support for TE2.x/PortableThemeEngine is introduced, and UXL Launcher 4.0 will fully remove support for TE1.x. Estimated deprecation timeline; may be changed at any moment:
    • TE1.x full support; TE2.x gains features to match what TE1.x can do <-- You Are Here
    • TE2.x support introduced; TE1.x is still the default but can be switched to using TE2.x via the UI
    • TE2.x becomes the default; TE1.x is deprecated but support is still available and can be used again through the UI
    • TE2.x is still the default; TE1.x is still available, but the UI to switch back to it is removed so you'll have to edit the config file instead
    • TE1.x support is fully removed; only TE2.x remains