Related: #i125226# disallow absolute and relative paths for DDE servers

(cherry picked from commit 6b64ada6)

Conflicts:
	sfx2/source/appl/impldde.cxx

Change-Id: I127add375a127dbbd0eaf12a10884e2636f1a332

sfx2/source/appl/impldde.cxx

@@ -25,6 +25,7 @@
 
 #include "impldde.hxx"
 
+#include <comphelper/string.hxx>
 #include <vcl/svapp.hxx>
 #include <vcl/fixed.hxx>
 #include <vcl/edit.hxx>
@@ -248,19 +249,20 @@ bool SvDDEObject::Connect( SvBaseLink * pSvLink )
         // check the suitability of starting the DDE server
         const SvtSecurityOptions aSecOpts;
         bool bForbidden = (aSecOpts.GetMacroSecurityLevel() == eNEVER_EXECUTE);
-        bForbidden |= (bInWinExec != false);
+        bForbidden |= (comphelper::string::indexOfAny(sServer, L":./%\\") != -1);
         static const char* aBadServers[] = { "cmd", "rundll32" };
         for (size_t i = 0; i < sizeof(aBadServers)/sizeof(*aBadServers); ++i)
             bForbidden |= sServer.equalsAscii(aBadServers[i]);
 
         // try to start the DDE server if it is not there already
+        bForbidden |= (bInWinExec != false);
         if( !bForbidden )
         {
             OStringBuffer aCmdLine(OUStringToOString(sServer, RTL_TEXTENCODING_ASCII_US));
             aCmdLine.append(".exe ");
             aCmdLine.append(OUStringToOString(sTopic, RTL_TEXTENCODING_ASCII_US));
 
-            if( WinExec( aCmdLine.getStr(), SW_SHOWMINIMIZED ) < 32 )
+            if( WinExec( aCmdLine.getStr(), SW_SHOWMINIMIZED ) < 32 ) // TODO: use CreateProcess() instead
                 nError = DDELINK_ERROR_APP;
             else
             {