On Tue, Jan 14, 2014 at 3:07 PM, Edward K. Ream <[email protected]> wrote:



> It would be best to define a convenience method, say
> c.config.isLocalSetting(settingName).  The mod_scripting plugin can then
> refuse to honor a local setting for ​@bool scripting-at-script-nodes.
>

​Done at rev ​

​6574.

If any file except leoSettings.leo and myLeoSettings.leo contain:

    @bool scripting-at-script-nodes = True

The log pane will warn:

    Security warning! Ignoring...
    @bool scripting-at-script-nodes = True
    This setting can be True only in
    leoSettings.leo or myLeoSettings.leo

And the following assert will pass in the local file::

    assert not c.theScriptingController.atScriptNodes

This emphasizes that accepting leoSettings.leo or myLeoSettings from
unknown sources is foolhardy.  As discussed several years ago, this is no
defense against "imposter" distributions of Leo.

Edward

-- 
You received this message because you are subscribed to the Google Groups 
"leo-editor" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/leo-editor.
For more options, visit https://groups.google.com/groups/opt_out.

Reply via email to