1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
From dfb6ecd9a4a129b976b7a8d2002e32146125340f Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Sun, 24 Apr 2011 18:26:47 +0200
Subject: [PATCH] Disable execution of embedded Python code unless run with
--enable-autoexec|-y|-666 (CVE-2009-3850)
---
source/blender/blenkernel/intern/blender.c | 3 ++-
source/blender/makesrna/intern/rna_userdef.c | 9 ++++++---
source/blender/windowmanager/intern/wm_files.c | 3 ++-
source/creator/creator.c | 10 ++++++----
4 files changed, 16 insertions(+), 9 deletions(-)
diff --git a/source/blender/blenkernel/intern/blender.c b/source/blender/blenkernel/intern/blender.c
index 5f08505..9c27ac7 100644
--- a/source/blender/blenkernel/intern/blender.c
+++ b/source/blender/blenkernel/intern/blender.c
@@ -141,7 +141,8 @@ void initglobals(void)
G.charmin = 0x0000;
G.charmax = 0xffff;
- G.f |= G_SCRIPT_AUTOEXEC;
+ G.f &= ~G_SCRIPT_AUTOEXEC;
+ G.f |= G_SCRIPT_OVERRIDE_PREF; /* Disables turning G_SCRIPT_AUTOEXEC on from user prefs */
}
/***/
diff --git a/source/blender/makesrna/intern/rna_userdef.c b/source/blender/makesrna/intern/rna_userdef.c
index e9a9ddc..a120857 100644
--- a/source/blender/makesrna/intern/rna_userdef.c
+++ b/source/blender/makesrna/intern/rna_userdef.c
@@ -99,9 +99,12 @@ static void rna_userdef_show_manipulator_update(Main *bmain, Scene *scene, Point
static void rna_userdef_script_autoexec_update(Main *bmain, Scene *scene, PointerRNA *ptr)
{
- UserDef *userdef = (UserDef*)ptr->data;
- if (userdef->flag & USER_SCRIPT_AUTOEXEC_DISABLE) G.f &= ~G_SCRIPT_AUTOEXEC;
- else G.f |= G_SCRIPT_AUTOEXEC;
+ if ((G.f & G_SCRIPT_OVERRIDE_PREF) == 0) {
+ /* Blender run with --enable-autoexec */
+ UserDef *userdef = (UserDef*)ptr->data;
+ if (userdef->flag & USER_SCRIPT_AUTOEXEC_DISABLE) G.f &= ~G_SCRIPT_AUTOEXEC;
+ else G.f |= G_SCRIPT_AUTOEXEC;
+ }
}
static void rna_userdef_mipmap_update(Main *bmain, Scene *scene, PointerRNA *ptr)
diff --git a/source/blender/windowmanager/intern/wm_files.c b/source/blender/windowmanager/intern/wm_files.c
index f4f7af0..c1bacc6 100644
--- a/source/blender/windowmanager/intern/wm_files.c
+++ b/source/blender/windowmanager/intern/wm_files.c
@@ -270,7 +270,8 @@ static void wm_init_userdef(bContext *C)
/* set the python auto-execute setting from user prefs */
/* enabled by default, unless explicitly enabled in the command line which overrides */
- if((G.f & G_SCRIPT_OVERRIDE_PREF) == 0) {
+ if (! G.background && ((G.f & G_SCRIPT_OVERRIDE_PREF) == 0)) {
+ /* Blender run with --enable-autoexec */
if ((U.flag & USER_SCRIPT_AUTOEXEC_DISABLE) == 0) G.f |= G_SCRIPT_AUTOEXEC;
else G.f &= ~G_SCRIPT_AUTOEXEC;
}
diff --git a/source/creator/creator.c b/source/creator/creator.c
index c687cc2..1da282f 100644
--- a/source/creator/creator.c
+++ b/source/creator/creator.c
@@ -278,6 +278,7 @@ static int print_help(int UNUSED(argc), const char **UNUSED(argv), void *data)
printf("\n");
+ BLI_argsPrintArgDoc(ba, "-666");
BLI_argsPrintArgDoc(ba, "--enable-autoexec");
BLI_argsPrintArgDoc(ba, "--disable-autoexec");
@@ -359,14 +360,14 @@ static int end_arguments(int UNUSED(argc), const char **UNUSED(argv), void *UNUS
static int enable_python(int UNUSED(argc), const char **UNUSED(argv), void *UNUSED(data))
{
G.f |= G_SCRIPT_AUTOEXEC;
- G.f |= G_SCRIPT_OVERRIDE_PREF;
+ G.f &= ~G_SCRIPT_OVERRIDE_PREF; /* Enables turning G_SCRIPT_AUTOEXEC off from user prefs */
return 0;
}
static int disable_python(int UNUSED(argc), const char **UNUSED(argv), void *UNUSED(data))
{
G.f &= ~G_SCRIPT_AUTOEXEC;
- G.f |= G_SCRIPT_OVERRIDE_PREF;
+ G.f |= G_SCRIPT_OVERRIDE_PREF; /* Disables turning G_SCRIPT_AUTOEXEC on from user prefs */
return 0;
}
@@ -1075,8 +1076,9 @@ static void setupArguments(bContext *C, bArgs *ba, SYS_SystemHandle *syshandle)
BLI_argsAdd(ba, 1, "-v", "--version", "\n\tPrint Blender version and exit", print_version, NULL);
- BLI_argsAdd(ba, 1, "-y", "--enable-autoexec", "\n\tEnable automatic python script execution (default)", enable_python, NULL);
- BLI_argsAdd(ba, 1, "-Y", "--disable-autoexec", "\n\tDisable automatic python script execution (pydrivers, pyconstraints, pynodes)", disable_python, NULL);
+ BLI_argsAdd(ba, 1, NULL, "-666", "\n\tEnable automatic python script execution (port from CVE-2009-3850 patch to Blender 2.49b)", enable_python, NULL);
+ BLI_argsAdd(ba, 1, "-y", "--enable-autoexec", "\n\tEnable automatic python script execution", enable_python, NULL);
+ BLI_argsAdd(ba, 1, "-Y", "--disable-autoexec", "\n\tDisable automatic python script execution (pydrivers, pyconstraints, pynodes) (default)", disable_python, NULL);
BLI_argsAdd(ba, 1, "-b", "--background", "<file>\n\tLoad <file> in background (often used for UI-less rendering)", background_mode, NULL);
--
1.7.5.rc1
|
GitWeb