minetest.git - lizzy's patches for luanti

Age	Commit message (Collapse)	Author
2016-12-20	Security: Fix resolving of some relative paths	ShadowNinja
	Trying to resolve a path with RemoveRelativePathComponents that can't be resolved without leaving leading parent components (e.g. "../worlds/foo" or "bar/../../worlds/foo") will fail. To work around this, we leave the relative components and simply remove the trailing components one at a time, and bail out when we find a parent component. This will still fail for paths like "worlds/foo/noexist/../auth.txt" (the path before the last parent component must not exist), but this is fine since you won't be able to open a file with a path like that anyways (the O.S. will determine that the path doesn't exist. Try `cat /a/../etc/passwd`).
2016-12-20	Mod security: Allow read-only access to all mod paths	ShadowNinja

2016-11-24	Fix secure io.lines	ShadowNinja
	It used to drop all of the return values from the insecure version of the function.
2016-11-24	Fix secure io.open without mode	ShadowNinja

2016-11-05	Fix memory leak in ::safeLoadFile (#4730)	Zeno-

2016-08-10	couple of memory leaks fixes.	David Carlier

2016-05-30	Remove unused code in s_security.cpp (#4172)	Zeno-
	Note that the macro CHECK_FILE_ERR implements the code removed
2016-03-03	Remove debug.getupvalue from the Lua sandbox whitelist	ShadowNinja
	This function could be used to steal insecure environments from trusted mods.
2015-08-27	Use numeric indices and raw table access with LUA_REGISTRYINDEX	Kahrl

2015-06-12	dofile error reporting for syntax errors	est31
	According to doc, dofile() raises an error when parsing failed due to syntax errors. Fixes #2775
2015-05-22	Fix Windows build, clean up included headers	SmallJoker
	Also fix a startup error caused by s_security.cpp
2015-05-16	Add mod security	ShadowNinja
	Due to compatibility concerns, this is temporarily disabled.