<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"><html><head><meta name="qrichtext" content="1" /><style type="text/css">p, li { white-space: pre-wrap; }</style></head><body style=" font-family:'Consolas'; font-size:11pt; font-weight:400; font-style:normal;">On Thursday 19 February 2009, John Tapsell wrote:<br>
> 2009/2/19 Michael Pyne:<br>
> > * If still not, could the user create the file? If not allow it.<br>
><br>
> Maybe allow only if the user can't write to it _and_ it's owned by<br>
> root? I can't think of a problem with your way, but.. I feel a bit<br>
> uneasy. Taking _away_ write permissions shouldn't suddenly allow the<br>
> desktop file to be executed.<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Why not, adding execute permissions does. :P<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>At least the idea so far from my point of view is that we want to make sure that simply saving a .desktop file doesn't result in a trojan that you can execute with one click, so we require it to be executable. Removing the write bit or adding the executable bit is still just one permission modification needed to allow a trojan .desktop file to execute.<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>> Just as a minor point:<br>
> requestResult.error = i18n("Service '%1' is malformatted.",<br>
> service->entryPath());<br>
> + if (service->isValid())<br>
> + requestResult.error = i18n("Service '%1' must be executable to<br>
> run.", service->entryPath());<br>
><br>
> Could you make this an if-else instead, just to save setting error<br>
> and then changing it. Save one i18n lookup :-)<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Sure, I've been trying to minimize branches in code for awhile now but here it is worth it to be sure not to use the extra i18n().<br>
<p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;"><br></p>Regards,<br>
- Michael Pyne</p></body></html>