Skip to content

Commit eba61df

Browse files
committed
Fix a possible security issue
- disallow overwriting config.ini
1 parent 0c3a256 commit eba61df

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/scripting/StelScriptOutput.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ void StelScriptOutput::saveOutputAs(const QString &name)
6262

6363
const bool okToSaveToAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_write_absolute_path", false).toBool();
6464

65+
if (name.contains("config.ini"))
66+
{
67+
qWarning() << "SCRIPTING ERROR: You are trying to overwrite config.ini. Ignoring.";
68+
return;
69+
}
70+
6571
if (!okToSaveToAbsolutePath && ((newFileNameInfo.isAbsolute() || (name.contains(".."))))) // The last condition may include dangerous/malicious paths
6672
{
6773
qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to save to an absolute pathname or move up in directories.";

0 commit comments

Comments
 (0)