 |
Implemented in svn revs 10503 and 16844. The new interface for user addons can be seen in tdm_main.script: // dragofer: add support for users to add custom addon scripts to their base installation, without relying on tdm_custom_scripts.script which is often already in use by FM authors // legacy approach 0005179: include one script which can be overrided by players #include "script/tdm_user_addons.script" // new approach 0006336: include all scripts with predefined prefix #include "script/tdm_user_addons_*.script" void tdm_main() { ... // dragofer: initialises any user addons included // legacy approach 0005179: run single function (immediately) user_addon_init(); // new approach 0006336: run all functions with predefined prefix (in new threads) sys.callFunctionsByWildcard("user_addon_init_*"); } |
 |
Updated instructions for creating user addons: https://wiki.thedarkmod.com/index.php?title=A_to_Z_Scripting:_Script_addons_for_players Announcement thread in the editor's guild subforum (set to hidden for now until some points are cleared up): https://forums.thedarkmod.com/index.php?/topic/22274-support-for-multiple-addons/ |
 |
I was trying to assess the security aspects of this implementation (executing code in arbitrary files added to a TDM folder). My main concern was that someone may add a file to the folder without the user's knowledge and that the content of that file was executed when the user started TDM. But from what I understand, scripts are confined to only affect variables and objects created by TDM at runtime, and thus this implementation should not pose a risk. Right? |
|
|
If attacker can modify anything inside your TDM installation directory, then you are screwed. There are so many opportunities for arbitrary code execution that executing game scripts is not even interesting. |
|
|
Yes, maybe you're right. Is my description of the scripts' limitations correct? |
- Anonymous
