[Bf-committers] Cant disable scripts

Campbell Barton ideasman42 at gmail.com
Sun Jun 1 03:09:48 CEST 2008


We should be able to disable scripts from
* from the user preferences, System & OpenGL,  Auto Run Python Scripts
"Enabled By Default"
* from the command line with '-y' argument

G.f & G_DOSCRIPTLINKS is used in a number of places for things other
then scriptlinks.

When opening blend files from an unknown source, they can run python
scripts which could do bad stuff, like remove all files in your home
directory for instance. even worse for systems that run as admin by
default.

This patch disables pyconstraints and pydrivers
https://projects.blender.org/tracker/index.php?func=detail&aid=13590&group_id=9&atid=127

However I couldnt manage to get PyNodes disabled when G_DOSCRIPTLINKS
flag is off because the flag isnt set when lib_verify_nodetree runs,
later setup_app_data sets G.f (called from BKE_read_file)

Simply disabling G_DOSCRIPTLINKS while lib_verify_nodetree runs
crashes blender a few second later.

Could someone (Willian or Jesterking) look into a way to disable pynodes.
otherwise we but this in the too hard basket and run untrusted blends
in a VM/chroot/underprivileged account.


More information about the Bf-committers mailing list