There is a second option if this is not meant for distribution. It is possible (or at least it was possible in the days of FF 1.5) to go into the GM source and modify it so that you could have your own custom functions in there and they could do what they wanted (well, OK, that's not really true - some security issues could be bypassed and some could not. For example, Cross Domain communication could not be bypassed in this fashion, as far as I could figure). This, for example, is how I come to have an emacs editor in every textarea - my custom GM traps keystrokes and rethrows them as appropriate.
The point is that if it's only meant for your system, you could perhaps make a special GM_eval that will do what you want. Just a thought. Csaba --- On Sat, 7/25/09, cc <[email protected]> wrote: > From: cc <[email protected]> > Subject: [greasemonkey-users] Re: execute String with GM_functions > To: [email protected] > Date: Saturday, July 25, 2009, 1:17 PM > > It's not the script you have to trust so much as the pages > it runs on. > And that's too much to expect from users, in general. Plus, > it adds > complexity (which usually means bugs and more strange > behavior) for very > little benefit to most users or even developers. > > Sorry about that, but security is security. > > > So probably your only option now is to use DOM events and > elements to > pass parameters from the eval()ed code to the GM_ functions > in the > script and return values back from the GM_functions in the > script to the > eval()ed code, which is what I was trying to get at in my > previous > messages. (Complicated, I know, but I'm fairly sure it can > be made to > work.) Does that make sense? > > Jan Buschtöns wrote: > > That's stupid... There should be a button like 'Trust > this Script'. Is > > there really _no other Way_ ? > > > > On 20 Jul., 20:38, Anthony Lieuallen <[email protected]> > wrote: > > > >> On 7/20/2009 2:36 PM, Jan Buschtöns wrote: > >> > >> > >>> That's not possible, because the GM_functions > must be executed on the > >>> actual page. > >>> > >> Actually, because they must _not_ be executed on > the page. They must be > >> executed within the script's sandbox. It's > impossible (given our > >> current knowledge) to consistently tell the > difference betweeneval() > >> and a malicious attack (coming from the page), so > it is blocked. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "greasemonkey-users" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/greasemonkey-users?hl=en -~----------~----~----~----~------~----~------~--~---
