[plasma/krdp] server: Session lock: unlock only after the connection is authenticated

Git commit 6fe728f33278c68c37444541b6b0659a5d803f25 by David Edmundson, on behalf of Nick Haghiri.
Committed on 22/07/2026 at 08:06.
Pushed by davidedmundson into branch 'master'.

Session lock: unlock only after the connection is authenticated

Unlocking in onNewConnection ran at TCP accept, before the RDP
handshake and PAM auth, so anyone able to open the port could unlock
the physical seat (logind Unlock is passwordless). Gate it on the
connection reaching Activated/Streaming instead.

M  +8    -2    server/SessionController.cpp

https://invent.kde.org/plasma/krdp/-/commit/6fe728f33278c68c37444541b6b0659a5d803f25

diff --git a/server/SessionController.cpp b/server/SessionController.cpp
index f5087df..4702dd6 100644
--- a/server/SessionController.cpp
+++ b/server/SessionController.cpp
@@ -173,8 +173,14 @@ void SessionController::onNewConnection(KRdp::RdpConnection *newConnection)
         wrapper->session->setActiveStream(*m_monitorIndex);
     }
     wrapper->connection->videoStream()->setVideoQuality(m_quality.value());
-    // A client is taking over; unlock the session so it sees the desktop.
-    setSessionLocked(false);
+    // Unlock only once the connection is authenticated and activated - NOT here, which
+    // runs at TCP accept before the RDP handshake / PAM auth. Otherwise anyone who can
+    // open the port could unlock the physical seat (logind Unlock is passwordless).
+    connect(newConnection, &KRdp::RdpConnection::stateChanged, this, [this](KRdp::RdpConnection::State state) {
+        if (state == KRdp::RdpConnection::State::Activated || state == KRdp::RdpConnection::State::Streaming) {
+            setSessionLocked(false);
+        }
+    });
     wrapper->session->start();
 
     connect(wrapper.get(), &SessionWrapper::connectionDestroyed, this, [this](SessionWrapper *wrapper) {