On 2017-08-06, Pavel Sanda wrote: > Guenter Milde wrote: >> > Q1: Can postscript (PS) code be embedded in a LyX document in such a >> > way such that it's parsed when doing a preview, or exporting a >> > document?
>> Not usually. > If you export to pdf then you need to convert each eps to pdf first and > there it gets parsed. For viewing you obviously need to parse it as > well. My answer was about the first part of the question: whether Postscript code can be *embedded* in the LyX document. I agree that, from a security point of view, also Postscript source files *referenced* in the LyX document and parsed during export and preview are important. For EPS to PDF this means we could preferably use "repstopdf" instead of "epstopdf". "repstopdf" is the version "whitelisted" in texmf.cnf for use with the restricted shell access. On my Debian system, it is just a symlink to epstopdf: lrwxrwxrwx 1 root root 8 Mär 13 16:12 /usr/bin/repstopdf -> epstopdf However, using the "restricted name" for the program call may ensure that no older insecure version is started. Günter