Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Store configuration files in a subdirectory #175

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

zoidbergthepopularone
Copy link

The is preferred due to the better security properties - the directory may be made writable without allowing modifications to the binary files. However, since this breaks compatibility with current installations, it is only used if the
directory exists. Otherwise the original behavior (config files directly next to the main binary files) is used.

The is preferred due to the better security properties - the directory may be made writable without allowing modifications to the binary files. However, since this breaks compatibility with current installations, it is only used if the
directory exists. Otherwise the original behavior (config files directly next to the main binary files) is used.
@zoidbergthepopularone
Copy link
Author

Refers to #71. It's not been tested because I can't compile the sources!

@kanryu
Copy link
Owner

kanryu commented Nov 23, 2021

I think there are two problems with this pull request.

  • The process of creating a'config'directory is not implemented.
  • Unlike when you first posted the Separate directory for config #71 issue, QuickViewer now saves files under AppDir when installed under'Program Files'. This behavior should solve the security problem you are looking for.

@zoidbergthepopularone
Copy link
Author

The process of creating the config directory is not implemented on purpose. I don't want to break the application for people who already have QuickViewer installed. That's why the directory is only used if it already exists. Implementing directory creation and file movement is more than I feel comfortable doing blind.

Saving files under AppDir does not solve the problem of configuration files stored in the directory with executables in the portable version. There it also makes sense to separate the configs (writable) and the binaries (read-only).

@kanryu
Copy link
Owner

kanryu commented Nov 25, 2021

  • As a general rule, applications should not implement behavior that is not intended by the user. In this case, the behavior will change with and without the'config'directory.
  • When an application is installed under'Program Files', it is common behavior on Windows today that configuration files are saved under'AppDir' for individual users. It is unlikely that this specification remains a security issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants