* notify the user that the save feature is disabled by default

* security warning when the user tries to set the save_dir to a dangerous location

CVS patchset: 5586
CVS date: 2003/10/24 09:34:01

4 files changed, 27 insertions, 6 deletions

diff --git a/include/xine.h.in b/include/xine.h.in
index 8a0ec2e31..7675cc4c6 100644
--- a/include/xine.h.in
+++ b/include/xine.h.in
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: xine.h.in,v 1.99 2003/10/22 16:49:26 mroi Exp $
+ * $Id: xine.h.in,v 1.100 2003/10/24 09:34:01 mroi Exp $
  *
  * public xine-lib (libxine) interface and documentation
  *
@@ -1576,7 +1576,8 @@ typedef struct {
 #define XINE_MSG_FILE_NOT_FOUND		6  /* (file name or mrl) */
 #define XINE_MSG_READ_ERROR		7  /* (device/file/mrl)  */
 #define XINE_MSG_LIBRARY_LOAD_ERROR	8  /* (library/decoder)  */
-#define XINE_MSG_ENCRYPTED_SOURCE	9  /* none */
+#define XINE_MSG_ENCRYPTED_SOURCE	9  /* none               */
+#define XINE_MSG_SECURITY		10 /* (security message) */
 
 /* opaque xine_event_queue_t */
 typedef struct xine_event_queue_s xine_event_queue_t;
diff --git a/src/xine-engine/input_rip.c b/src/xine-engine/input_rip.c
index b96d3414d..8b5cfbb08 100644
--- a/src/xine-engine/input_rip.c
+++ b/src/xine-engine/input_rip.c
@@ -29,7 +29,7 @@
  * - it's possible speeder saving streams in the xine without playing:
  *     xine stream_mrl#save:file.raw\;noaudio\;novideo
  *
- * $Id: input_rip.c,v 1.8 2003/10/20 08:36:57 valtri Exp $
+ * $Id: input_rip.c,v 1.9 2003/10/24 09:34:01 mroi Exp $
  */
 
 /* TODO:
@@ -540,6 +540,8 @@ input_plugin_t *rip_plugin_get_instance (xine_stream_t *stream, const char *file
   if (!stream->xine->save_path[0]) {
     xine_log(stream->xine, XINE_LOG_MSG,
       _("input_rip: target directory wasn't specified, please fill out the option 'misc.save_dir'\n"));
+    xine_message(stream, XINE_MSG_SECURITY,
+      _("The stream save feature is disabled until you set misc.save_dir in the configuration."));
     return NULL;
   }
   
diff --git a/src/xine-engine/xine.c b/src/xine-engine/xine.c
index ddca0f974..dd275149f 100644
--- a/src/xine-engine/xine.c
+++ b/src/xine-engine/xine.c
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: xine.c,v 1.259 2003/10/20 08:36:57 valtri Exp $
+ * $Id: xine.c,v 1.260 2003/10/24 09:34:01 mroi Exp $
  */
 
 /*
@@ -1222,7 +1222,24 @@ static void config_demux_strategy_cb (void *this_gen, xine_cfg_entry_t *entry) {
 
 static void config_save_cb (void *this_gen, xine_cfg_entry_t *entry) {
   xine_t *this = (xine_t *)this_gen;
+  char *homedir_trail_slash = strcat(strdup(xine_get_homedir()), "/");
 
+  if (entry->str_value[0] &&
+      (entry->str_value[0] != '/' || strstr(entry->str_value, "/.") ||
+       strcmp(entry->str_value, xine_get_homedir()) == 0 ||
+       strcmp(entry->str_value, homedir_trail_slash) == 0)) {
+    xine_stream_t *stream;
+    
+    xine_log(this, XINE_LOG_MSG,
+      _("xine: The specified save_dir \"%s\" might be a security risk.\n"), entry->str_value);
+    
+    pthread_mutex_lock(&this->streams_lock);
+    if ((stream = (xine_stream_t *)xine_list_first_content(this->streams)))
+      xine_message(stream, XINE_MSG_SECURITY, _("The specified save_dir might be a security risk."), NULL);
+    pthread_mutex_unlock(&this->streams_lock);
+  }
+  
+  free(homedir_trail_slash);
   this->save_path = entry->str_value;
 }
 
diff --git a/src/xine-engine/xine_interface.c b/src/xine-engine/xine_interface.c
index db60e60e7..1aab5feea 100644
--- a/src/xine-engine/xine_interface.c
+++ b/src/xine-engine/xine_interface.c
@@ -17,7 +17,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
  *
- * $Id: xine_interface.c,v 1.60 2003/10/21 22:10:34 f1rmb Exp $
+ * $Id: xine_interface.c,v 1.61 2003/10/24 09:34:01 mroi Exp $
  *
  * convenience/abstraction layer, functions to implement
  * libxine's public interface
@@ -772,7 +772,7 @@ int xine_message(xine_stream_t *stream, int type, ...) {
 
   static char *std_explanation[] = {
     "",
-    "Warning",
+    "Warning:",
     "Unknown host:",
     "Unknown device:",
     "Network unreachable",
@@ -781,6 +781,7 @@ int xine_message(xine_stream_t *stream, int type, ...) {
     "Read error from:",
     "Error loading library:",
     "Encrypted media stream detected",
+    "Security message:"
   };
 
   if( type >= 0 && type < sizeof(std_explanation)/