can qtscript plasmoids load C++ qtscript plugins

[Aaron J. Seigo]

On November 12, 2009, Pekka Reijula wrote:
> Our idea allows creation of plasmoids that have qtscript inside to your own
> plama desktop environment. We can extend plasma in a way that allows user
>  to write own script with for example Kate or download it from http url.
>  The basic idea is that only text is read and script is evaluated. All that
>  you need for this is the qtscript-bindings that for example amarok uses.

the question is this:

		do these plasmoids need the full Qt API?

if so, then they are inherently untrustable from a security perspective, 
though that's not necessarily a bad thing. it just means that you don't want 
to be loading these things from people and places you don't implicitly trust. 
it would also mean that you are looking for Smoke bindings that Richard 
mentioned.

if there is specific API in addition to the 'standard' Simplified JavaScript 
API currently provided in the javascript AppletScriptEngine, then if that 
specific API is offered as a QScriptEngine extension, it can be loaded given 
enough permission/trust is bestowed on that plasmoid (e.g. by a valid gpg 
signature that is trusted by the user).

the other day i added support for two properties in the .desktop metadata file 
of a plasmoid:

	X-Plasma-RequiredExtensions and X-Plasma-OptionalExtensions

these are both string lists and can be used to load QScriptEngine extensions 
upon request. a security sandbox is being established around this mechanism, 
so it should be reasonably safe.

> I could upload the plasmoid
> sources to kde, but I'm not yet a plasma developer.

if you get a kde svn account you can upload them to playground quite easily:

	http://techbase.kde.org/Contribute/Get_a_SVN_Account

-- 
Aaron J. Seigo
humru othro a kohnu se
GPG Fingerprint: 8B8B 2209 0C6F 7C47 B1EA  EE75 D6B7 2EB1 A7F1 DB43

KDE core developer sponsored by Qt Development Frameworks
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
Url : http://mail.kde.org/pipermail/plasma-devel/attachments/20091113/336f02db/attachment.sig