Security Patch [Relevant for Modders]

[koonschi]

Date: August 12th, 2019

 

Hey guys,

 

We're doing a quick security patch today that also affects the Scripting API.

 

Scripting API

 

"We're adjusting the Server API privileges to the Client API privileges."

• Server Scripting API: Removed os.execute() and similar functionality
  
• Server Scripting API: Removed all functionality for loading/executing binary files
  
• Server Scripting API: Removed functionality to write-access any file on the system
  
  • Write access only allowed for %AppData%\Avorion\moddata\ and galaxy folder
    
  • Read access only allowed for %AppData%\Avorion\, installation folder, galaxy folder and folders of enabled mods
    
  • On unix-based systems, replace %AppData% with ~/.avorion
    

 

We still want mods to be able to communicate with external tools, of course. In order to make up for the lost functionality, we'll be adding a socket library in the near future.

 

[Hammelpilaw]

We still want mods to be able to communicate with external tools, of course. In order to make up for the lost functionality, we'll be adding a socket library in the near future.

 

Awesome. Do you already have any information about how this will work?

[koonschi]

We're probably going to use an established library like lua socket or something similar.

[SubVision]

On 8/12/2019 at 6:23 PM, koonschi said:

We're probably going to use an established library like lua socket or something similar.

Hi! Did you add lua socket or something similar? i'd like to use it, i have already estabilished code to communicate with my c# app, it would be nice to use socked instead of files

 

[edraft]

On 8/12/2019 at 3:17 PM, koonschi said:

We still want mods to be able to communicate with external tools, of course. In order to make up for the lost functionality, we'll be adding a socket library in the near future.

 

What is the current situation?
I need the http client for a mod I'm working on.