Author |
Topic: Question about file and folder access... (Read 13205 times) |
|
Didier Guillion
Administrator
WWW | Email
Gender: 
Posts: 8420
|
 |
Question about file and folder access...
« on: Jan 19th, 2003, 3:18pm » |
Quote | Modify
|
Hi,
I added some special functions in the File object type which allow a script to write, modify, remove or rename a file (see page 201).
I am not sure it is a good idea because this can be dangerous.
I can restrict these functions to the user's document folder to be sure a script will not change an essential system file.
Why do you think of this ?
What is better : full liberty with some risks or restricted liberty but more secure ?
Best regards
|
|
 offline |
Myriad Team
|
|
|
Sylvain Machefert
Administrator
WWW |
Gender:
Posts: 7102
|
 |
Re: Question about file and folder access...
« Reply #1 on: Jan 19th, 2003, 4:43pm » |
Quote | Modify
|
Yeah! I've an idea ! 
Non restricted for reading.
Restricted to the user's Myriad Documents folder and sub-folders for writing/deleting/renaming but...
In the Setup options, an ability to add paths that a MyrScript can write/delete/rename....
What do you think ?
Example, scripts are restricted to My Documents\Myriad Documents.... I've some .mus files in another paths (e.g. on my network) so I add rights to MyrScript to write/modify... in the paths \\Network\Computer\........
|
|
offline |
HA+HQ+VS+PdfToM, Reaper+Audiveris+Transcribe, Win10+Focusrite Scarlet 4i4+Nord Electro 3
Linktree: VS languages, my scripts, my bands, my performances...
|
|
|
Didier Guillion
Administrator
WWW | Email
Gender:
Posts: 8420
|
|
Re: Question about file and folder access...
« Reply #2 on: Jan 19th, 2003, 6:32pm » |
Quote | Modify
|
Hi,
Thanks for your suggestion Sylvain. May be a little bit complicated for standard users. (Why only one another path ?)
We can imagine an option (General setup) which allow to :
- If active (by default) access are authorised only on the user's working space (Myriad Documents folder)
- If false, all access are authorised.
Best regards.
|
|
offline |
Myriad Team
|
|
|
Sylvain Machefert
Administrator
WWW |
Gender:
Posts: 7102
|
|
Re: Question about file and folder access...
« Reply #3 on: Jan 19th, 2003, 7:38pm » |
Quote | Modify
|
I didn't say only one path
Quote:We can imagine an option (General setup) which allow to :
- If active (by default) access are authorised only on the user's working space (Myriad Documents folder)
- If false, all access are authorised. |
|
Yes an option here... but
By default, only access to myriad document.
and a list of paths that can be accessed, and a Add button to add another paths (one by one), and a Remove button to remove one selected path from the list.
And another option to access to the entire system (but maybe dangerous!!)
|
|
offline |
HA+HQ+VS+PdfToM, Reaper+Audiveris+Transcribe, Win10+Focusrite Scarlet 4i4+Nord Electro 3
Linktree: VS languages, my scripts, my bands, my performances...
|
|
|
dewdman42
Board Full Member
  
Posts: 106
|
|
Re: Question about file and folder access...
« Reply #4 on: Jan 19th, 2003, 8:20pm » |
Quote | Modify
|
Hmm...
I think it would be very very useful to be able to edit files in any directory. I certainly don't store my MUS files all in one place. However I can see the problem about editing system files.
You could restrain MyScript from being able to change anything in the C:\Windows or C:\WINNT or macintosh System Folder, etc.. if you wanted to. Not a bad idea to avoid catastrophic problems.
But besides that, I think it ought to be able to open anything anywhere...ESPECIALLY files with the .MUS extension.
Perhaps the solution is that a script or HA preference must first define allowable extension types and then allow opening/changing of any file with those extension types from any directory. My default, .MUS files would always work, but a script or preference dialog could define other extension types that are valid to open anywhere in addition to .MUS. With the Mac..I guess it would have to be using the TYPE or CREATOR resource fork items to determine if its a valid type of file to access in MyrScript.
Beyond that, I think MyrScript should be able to open ANY file anywhere in read only mode...regardless of the extension type (so long as the current user has permissions to do so).
This topic inspires me to think of another cool feature of MyrScript, which would be to programmatically access/modify the HA preferences. Maybe there already?
|
|
offline |
|
|
|
dewdman42
Board Full Member
Posts: 106
|
|
Re: Question about file and folder access...
« Reply #6 on: Jan 19th, 2003, 8:36pm » |
Quote | Modify
|
Kewl...I should have known...
|
|
offline |
|
|
|
Pierpaolo BERNARDI
Beta-tester
Board Junior Member
Posts: 89
|
|
Re: Question about file and folder access...
« Reply #7 on: Jan 20th, 2003, 4:12am » |
Quote | Modify
|
on Jan 19th, 2003, 6:32pm, Didier Guillion wrote:Hi,
We can imagine an option (General setup) which allow to :
- If active (by default) access are authorised only on the user's working space (Myriad Documents folder)
- If false, all access are authorised.
|
|
You could make this a three way choice: the first two like you write above,
plus an intermediate level: every time a file system operation
is attempted, a popup window opens and asks for a confirmation from the user.
In this popup window there could also be the option to
give trust to the script which caused it, and make it proceed
without further interruptions. So we can give trust to scripts
which we write ourselves.
Cheers
Pierpaolo
|
|
offline |
|
|
|
Pierpaolo BERNARDI
Beta-tester
Board Junior Member
Posts: 89
|
|
Re: Question about file and folder access...
« Reply #8 on: Jan 20th, 2003, 4:15am » |
Quote | Modify
|
P.S. Do you plan to stay with Lua 4, or to switch to 5
when it goes out of beta?
Do you have an estimate of when the scriptable harmony
will be released? (I am too impatient, I know).
P.
|
|
offline |
|
|
|
Didier Guillion
Administrator
WWW | Email
Gender:
Posts: 8420
|
|
Re: Question about file and folder access...
« Reply #9 on: Jan 20th, 2003, 4:55am » |
Quote | Modify
|
Hi,
Thanks to all to your suggestions. A list of path will work but is to complex to manage for the user.
Musical files are selected with a special function (GetMusicFileNameLoad page 194) and I my mind there is no need to forbide access to this kind of function. The user can select the file he want.
May be, as suggested, we can allow the access to all the user's working space except the System path.
Now I 'll debate of this with the second half of the Myriad Team...
About the question on LUA. We follow the progress of Lua 5 but, for the moment, Lua 5 is still in Beta and for our needs, Lua 4 works very, very well.
We can hope a first Beta version of MyrScript in February.
Best regards
|
| « Last Edit: Jan 20th, 2003, 4:56am by Didier Guillion » |
offline |
Myriad Team
|
|
|
Pierpaolo BERNARDI
Beta-tester
Board Junior Member
Posts: 89
|
|
Re: Question about file and folder access...
« Reply #10 on: Jan 20th, 2003, 6:47am » |
Quote | Modify
|
on Jan 20th, 2003, 4:55am, Didier Guillion wrote:Hi,
About the question on LUA. We follow the progress of Lua 5 but, for the moment, Lua 5 is still in Beta and for our needs, Lua 4 works very, very well.
We can hope a first Beta version of MyrScript in February.
|
|
That's great! (both points). Thanks.
P.
|
|
offline |
|
|
|
COMALite J
Beta-tester
Board Master
Email
Gender:
Posts: 812
|
|
Re: Question about file and folder access...
« Reply #11 on: Jan 20th, 2003, 4:35pm » |
Quote | Modify
|
While I'm pretty sure that nobody in our community here would do such a thing, remember that Myriad products are freely downloadable for trial purposes, and there are people out there who will cheat any way they can (remember the people who brazenly come here and ask for registration keys for Harmony? Sheesh!).
We have learned from sad experience that any scripting feature that can write to files can be co-opted by those who want to write malware.
With this in mind, I recommend that any silent or direct file access be restricted to the Myriad Documents folder. Any other file access must be done by calls to the regular File Open / Save / Import / Export functions, which will call up the appropriate dialog box (showing the end-user exactly which file, and from where, you intend to access, and in what way), and thus require confirmation from the end-user. I know this will limit the potential power of scripts somewhat, but I fear that it's necessary. How much harm has been caused because Microsoft felt it necessary to give word processors and E-Mail programs the ability to silently rename, delete and overwrite files from a scripting language?
|
|
offline |
|
|
|
Didier Guillion
Administrator
WWW | Email
Gender:
Posts: 8420
|
|
Re: Question about file and folder access...
« Reply #12 on: Jan 20th, 2003, 5:02pm » |
Quote | Modify
|
Hi,
Totaly agree. I 'll work on this tomorrow.
All low levels access will be restricted to the user's area.
A setup in the preferences will allow to disable this, but by default, this option will be active.
Best regards
|
|
offline |
Myriad Team
|
|
|
COMALite J
Beta-tester
Board Master
Email
Gender:
Posts: 812
|
|
Re: Question about file and folder access...
« Reply #13 on: Jan 20th, 2003, 11:59pm » |
Quote | Modify
|
After giving this some more thought, and analyzing the structure of the Myriad Documents folder, I propose the following (new folders would be in Brown):
- Myriad Documents
- Export
- Music
- Scripts
- Commands
- Exporters
- Importers
- etc....
- Settings
- Accordions
- Charsets
- Chords
- Drums
- Engraver
- FXs
- Instruments
- Keyboards
- MidiMap
- Models
- Organs
- Palettes
- Rules
- ScriptSettings
- Voices
The idea here is to provide a place within the Settings folder for Scripts to store their own settings (to, for instance, store the user's most recent choices in the Script's dialog box, for re-use).
Read-write permission would be granted to the Myriad Documents\Music and ...\Export folders, except that any deletions, renames, or overwrites must be confirmed by the user (either one at a time, or by granting limited-duration permission for purposes of batch processing {e. g. a "[Yes to All]" button}).
Read-only permission would be granted by default to the ...\Settings folder (to allow a Script to act on an existing setting, but not to change it), except for the ...\Settings\ScriptSettings folder. Here the Script can read or write only to a file named the same as the Script itself (with a different extension, of course) and located within this folder. The format of the file is up to the Script.
|
|
offline |
|
|
|
Didier Guillion
Administrator
WWW | Email
Gender:
Posts: 8420
|
|
Re: Question about file and folder access...
« Reply #14 on: Jan 21st, 2003, 10:20am » |
Quote | Modify
|
Hi,
The hierarchy you propose is what we have done.
This morning, I implemented the restricted access to the folder, here is a description of this feature (part of the next manual version)
Security
A special mode forbiddes a script to apply some operations on sensitive folder, like system folder for example.
When this mode is active, opening a file for writing, renaming, removing outside :
·the user's data folder(aka the "Myriad Documents" folder),
·the Temporary folder (provided by GetTemporaryFilesPathName)
·the MyrScript Preferences folder (provided by GetPreferencesPathName)
opens automaticaly a dialog box, asking the user for a confirmation. The user can cancel the script command and the function will return an error to your script.
You ought to handle correctly this error in your script.
By default, this mode is active but the user can changes its state in the general setup, "Scripts" pannel.
The access to musical files using the LoafFile function then the Score.Save method is not restricted.
Best regards
|
|
offline |
Myriad Team
|
|
|
|
