https://bugzilla.wikimedia.org/show_bug.cgi?id=47300

Brad Jorsch <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch-in-gerrit

--- Comment #2 from Brad Jorsch <[email protected]> ---
(In reply to comment #1)
> So the loadPackage() closure from the base environment is retained in the
> cloned environment, and so loaded chunks have their environment set to the
> base environment before they are called.

I found the same thing.

> Replacing "package = package or {}" with "package = {}" appears to fix the
> problem, and all tests still pass after that is done.

Other fixes include only doing this to package.loaders, or clearing
env.package.loaders in mw.lua's makePackageModule. I'd prefer either of these,
so package.loaded continues to contain entries for the various Scribunto
libraries.

There's a similar hole in mw.loadData, where it uses the outer sandbox's
require and so the loaded module was again getting the outer sandbox's
environment.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l

Reply via email to