|
From: Rebecca N. P. <reb...@zo...> - 2015-11-21 22:03:20
|
On 12/07/15 18:44 ( http://sourceforge.net/p/flightgear/mailman/flightgear-devel/thread/55A2A775.7060108%40zoho.com/#msg34289022 ), Rebecca N. Palmer wrote: > In 3.7, I plan to: > -Make realpath() on a nonexistent file f return > SGPath(f.dir()).realpath()+"/"+f.file(), ie "realpath f would have if > created now", instead of just returning f unchanged. > -Use this realpath() in fgValidatePath, and get rid of the now-redundant > fgNormalizePath. I finally got around to doing this; as usual, I can only test on Linux, so if anything breaks elsewhere, please report it. On 30/07/15 23:12 ( http://sourceforge.net/p/flightgear/mailman/flightgear-devel/thread/55B9CA69.6060201%40zoho.com/#msg34331214 ), Rebecca N. Palmer wrote: > An alternative solution [to allow 3rd party scenery to use Nasal without making /sim/terrasync/scenery-dir a can-read-anything security hole] would be to internally have two variables: the current fg_scenery (includes terrasync dir) and a new secure_fg_scenery (explicitly-set fg-scenery only), and allow the latter. Ugly, but unlike the "throw out /sim/terrasync/scenery-dir" option, at least not end-user-facing ugly. I'm thinking of trying this as well; comments? |