Re: $HOME in loadpath - Re: Getting ready to put out a 4.6 release candidate

[Petr M. <mi...@ph...>]

> > "/home/mikulik/.gnuplot", line 3: Pipes and shell commands not permitted 
> > during intialization

A typo: intialization => initialization

> > WARNING: Error during initialization
> > 
> > I think it would be better to avoid $HOME/.gnuplot completely during "make", 
> > but allow anything during ordinary gnuplot use.
> 
> Issue 1:
> 
> I would go even further, and say that it should not be necessary to 
> run gnuplot in order to "make" gnuplot.
> 
> The failure you see comes specifically from doing a "make" in the 
> PostScript tutorial subdirectory.  I agree that this shouldn't be part of
> the default set of "make" targets, but it has been since forever.
> To avoid rebuilding the tutorial on every make, you have to do  
> "./configure --without-tutorial". I have that in my default build script.  
> But then you can't build it later on even if you want to, so yes, 
> it is a bug in the build system.
> 
> I think the tutorial should just be an optional make target, similar to
> the various optional targets in the ../docs or ../demo directories.  
> Then it would not require a special option in ./configure.  
> It would not be recreated by "make", only by "make tutorial".  

Unfortunately INSTALL does not list the possible targets; I think it would 
be useful to list them (pdf, tutorial, pdffigures(?), ...).


> Issue 2:
> > set loadpath "`echo $HOME`/foo"
> > 
> > I don't know any other way how to get the home dir there (except for 
> > GNUPLOT_LIB via shell's rc script); the "~" is not expanded.
> 
> By coincidence, I ran into the same issue myself just a couple of
> days ago.  So I fixed it.   As of yesterday, both "set loadpath"
> and "set fontpath"  call gp_expand_tilde().   I don't know why they have
> not always done so - perhaps it was just an oversight.

I have that   set loadpath "`echo $HOME`/foo"  for ages and never realized 
I could ask for "~" expansion :-(



> Issue 3 (this is the major one):
> > I have the following line in my $HOME/.gnuplot:
> > set loadpath "`echo $HOME`/usr/lib/gnuplot"
> 
> In preparation for 4.6, last month I looked through all the configure options.
> I was appalled to discover that the option
>    --with-cwdrc    check current directory for .gnuplot file,
>                    normally disabled for security reasons

> So at the same time I fixed the configuration option, I disabled running 
> shell commands from the initialization code.

If an intruder can damage your $HOME/.gnuplot file, then it can do much 
worse things. So I would allow shell commands.


> It is true that the "time bomb" scenario is less of a concern for the
> initialization file in your home directory than it is for files in other,
> shared, directories.  So it would be possible to make a distinction between
> what is allowed in ~/.gnuplot and what is allowed in $CWD/.gnuplot or
> $GNUPLOT_SHARE_DIR/gnuplotrc etc.  The particular example you showed can
> be fixed without this (and has been); can you think of other legitimate
> reasons to invoke a shell command from ~/.gnuplot?

I have used several times $CWD/.gnuplot which set some commands or hotkeys 
and then loaded $HOME/.gnuplot. But you can achieve the same by
	gnuplot .gnuplot -
and thus the $CWD/.gnuplot feature is not necessary. 


---
Petr