vlc security: As i've seen very little improvement on that front, i've decided to...

[vlc] / src / libvlc-module.c

diff --git a/src/libvlc-module.c b/src/libvlc-module.c
index 0d655a6da74fc5f96e31cbed86152c3c8c371de7..156de1df174946f1d34a951a6baa08ebd3800ed1 100644 (file)
--- a/src/libvlc-module.c
+++ b/src/libvlc-module.c
@@ -977,6 +977,14 @@ static const char *ppsz_clock_descriptions[] =
 #define MINIMIZE_THREADS_LONGTEXT N_( \
      "This option minimizes the number of threads needed to run VLC.")
 
+#define SECURITY_POLICY_TEXT N_("Policy for handling unsafe options.")
+#define SECURITY_POLICY_LONGTEXT N_( \
+     "This option dictates the default policy when processing options " \
+     "which may be harmful when used in a malicious way.")
+
+static int pi_secpolicy_values[] = { 0, 1, 2 };
+static const char *ppsz_secpolicy_descriptions[] = { N_("Block"), N_("Allow"), N_("Prompt") };
+
 #define PLUGIN_PATH_TEXT N_("Modules search path")
 #define PLUGIN_PATH_LONGTEXT N_( \
     "Additional path for VLC to look for its modules.")
@@ -1481,6 +1489,7 @@ vlc_module_begin();
     set_section( N_("Snapshot") , NULL );
     add_directory( "snapshot-path", NULL, NULL, SNAP_PATH_TEXT,
                    SNAP_PATH_LONGTEXT, VLC_FALSE );
+        change_unsafe();
     add_string( "snapshot-prefix", "vlcsnap-", NULL, SNAP_PREFIX_TEXT,
                    SNAP_PREFIX_LONGTEXT, VLC_FALSE );
     add_string( "snapshot-format", "png", NULL, SNAP_FORMAT_TEXT,
@@ -1786,12 +1795,20 @@ vlc_module_begin();
     add_directory( "plugin-path", NULL, NULL, PLUGIN_PATH_TEXT,
                    PLUGIN_PATH_LONGTEXT, VLC_TRUE );
         change_need_restart();
+        change_unsafe();
 
     set_section( N_("Performance options"), NULL );
     add_bool( "minimize-threads", 0, NULL, MINIMIZE_THREADS_TEXT,
               MINIMIZE_THREADS_LONGTEXT, VLC_TRUE );
         change_need_restart();
 
+    set_section( N_("Security options"), NULL );
+    add_integer( "security-policy", 2, NULL, SECURITY_POLICY_TEXT,
+              SECURITY_POLICY_LONGTEXT, VLC_TRUE );
+        change_integer_list( pi_secpolicy_values, ppsz_secpolicy_descriptions, 0 );
+        change_unsafe();
+        change_need_restart();
+
 #if !defined(__APPLE__) && !defined(SYS_BEOS) && defined(PTHREAD_COND_T_IN_PTHREAD_H)
     add_bool( "rt-priority", VLC_FALSE, NULL, RT_PRIORITY_TEXT,
               RT_PRIORITY_LONGTEXT, VLC_TRUE );