Merge branch 'master' of https://github.com/minetest/minetest

[dragonfireclient.git] / src / script / cpp_api / s_security.cpp

diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index 01333b941505369345cef6e80bcfc41f6ee5b0aa..37c5b61dcf89a7841b35a1c817628a76c7a3cb57 100644 (file)
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -90,6 +90,7 @@ void ScriptApiSecurity::initializeSecurity()
                "math",
        };
        static const char *io_whitelist[] = {
+               "open",
                "close",
                "flush",
                "read",
@@ -173,7 +174,7 @@ void ScriptApiSecurity::initializeSecurity()
        copy_safe(L, io_whitelist, sizeof(io_whitelist));
 
        // And replace unsafe ones
-       SECURE_API(io, open);
+       //SECURE_API(io, open);
        SECURE_API(io, input);
        SECURE_API(io, output);
        SECURE_API(io, lines);
@@ -267,7 +268,6 @@ void ScriptApiSecurity::initializeSecurityClient()
                "getinfo",
                "traceback"
        };
-
 #if USE_LUAJIT
        static const char *jit_whitelist[] = {
                "arch",
@@ -287,6 +287,10 @@ void ScriptApiSecurity::initializeSecurityClient()
        lua_State *L = getStack();
        int thread = getThread(L);
 
+       // Backup globals to the registry
+       lua_getglobal(L, "_G");
+       lua_rawseti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_GLOBALS_BACKUP);
+
        // create an empty environment
        createEmptyEnv(L);
 
@@ -303,8 +307,6 @@ void ScriptApiSecurity::initializeSecurityClient()
        SECURE_API(g, require);
        lua_pop(L, 2);
 
-
-
        // Copy safe OS functions
        lua_getglobal(L, "os");
        lua_newtable(L);
@@ -319,6 +321,7 @@ void ScriptApiSecurity::initializeSecurityClient()
        copy_safe(L, debug_whitelist, sizeof(debug_whitelist));
        lua_setfield(L, -3, "debug");
        lua_pop(L, 1);  // Pop old debug
+       
 
 #if USE_LUAJIT
        // Copy safe jit functions, if they exist
@@ -398,10 +401,9 @@ bool ScriptApiSecurity::safeLoadFile(lua_State *L, const char *path, const char
                        lua_pushfstring(L, "%s: %s", path, strerror(errno));
                        return false;
                }
-               chunk_name = new char[strlen(display_name) + 2];
-               chunk_name[0] = '@';
-               chunk_name[1] = '\0';
-               strcat(chunk_name, display_name);
+               size_t len = strlen(display_name) + 2;
+               chunk_name = new char[len];
+               snprintf(chunk_name, len, "@%s", display_name);
        }
 
        size_t start = 0;