Don't look for weston.ini in the current working directory
It's a bit surprising that Weston looks different when launched from the root of the git repo vs from elsewhere. But it's also technically a security vulnerability: if I launch it from a directory like /tmp, it might pick up a weston.ini created by another user, which could then load modules with arbitrary code. Basically, it's the same problem as including "." in $PATH. Signed-off-by: Dima Ryazanov <dima@gmail.com>
This commit is contained in:
@@ -75,8 +75,7 @@ open_config_file(struct weston_config *c, const char *name)
|
||||
}
|
||||
|
||||
/* Precedence is given to config files in the home directory,
|
||||
* and then to directories listed in XDG_CONFIG_DIRS and
|
||||
* finally to the current working directory. */
|
||||
* then to directories listed in XDG_CONFIG_DIRS. */
|
||||
|
||||
/* $XDG_CONFIG_HOME */
|
||||
if (config_dir) {
|
||||
@@ -111,10 +110,7 @@ open_config_file(struct weston_config *c, const char *name)
|
||||
next++;
|
||||
}
|
||||
|
||||
/* Current working directory. */
|
||||
snprintf(c->path, sizeof c->path, "./%s", name);
|
||||
|
||||
return open(c->path, O_RDONLY | O_CLOEXEC);
|
||||
return -1;
|
||||
}
|
||||
|
||||
static struct weston_config_entry *
|
||||
|
||||
Reference in New Issue
Block a user