Re: [fossil-users] With jimtcl available can we have hooks that trigger tcl scripts stored in the db?

2012-02-14 Thread Richard Hipp
On Mon, Feb 13, 2012 at 9:26 PM, Leo Razoumov slonik...@gmail.com wrote: Are TH1 and Tcl interpreters properly sand-boxed? Otherwise, downloading and running random scripts found in some random repos does not strike me as a sound security. The only actions TH1 can take are to output text or

Re: [fossil-users] With jimtcl available can we have hooks that trigger tcl scripts stored in the db?

2012-02-14 Thread Richard Hipp
On Tue, Feb 14, 2012 at 7:53 AM, Richard Hipp d...@sqlite.org wrote: On Mon, Feb 13, 2012 at 9:26 PM, Leo Razoumov slonik...@gmail.com wrote: Are TH1 and Tcl interpreters properly sand-boxed? Otherwise, downloading and running random scripts found in some random repos does not strike me as

Re: [fossil-users] With jimtcl available can we have hooks that trigger tcl scripts stored in the db?

2012-02-14 Thread Leo Razoumov
On Tue, Feb 14, 2012 at 07:53, Richard Hipp d...@sqlite.org wrote: (4) Scripts are only exchanged between repositories on a fossil clone or fossil configuration pull/sync.  For the latter, detailed warnings about changes to scripts and recommendations to redo audits might be in order. IMHO

Re: [fossil-users] With jimtcl available can we have hooks that trigger tcl scripts stored in the db?

2012-02-14 Thread Martin Gagnon
On Tue, Feb 14, 2012 at 01:01:39PM -0500, Leo Razoumov wrote: On Tue, Feb 14, 2012 at 07:53, Richard Hipp d...@sqlite.org wrote: (4) Scripts are only exchanged between repositories on a fossil clone or fossil configuration pull/sync.  For the latter, detailed warnings about changes to