Skip to content

Conversation

zoidbergthepopularone
Copy link

The is preferred due to the better security properties - the directory may be made writable without allowing modifications to the binary files. However, since this breaks compatibility with current installations, it is only used if the
directory exists. Otherwise the original behavior (config files directly next to the main binary files) is used.

The is preferred due to the better security properties - the directory may be made writable without allowing modifications to the binary files. However, since this breaks compatibility with current installations, it is only used if the
directory exists. Otherwise the original behavior (config files directly next to the main binary files) is used.
@zoidbergthepopularone
Copy link
Author

Refers to #71. It's not been tested because I can't compile the sources!

@kanryu
Copy link
Owner

kanryu commented Nov 23, 2021

I think there are two problems with this pull request.

  • The process of creating a'config'directory is not implemented.
  • Unlike when you first posted the Separate directory for config #71 issue, QuickViewer now saves files under AppDir when installed under'Program Files'. This behavior should solve the security problem you are looking for.

@zoidbergthepopularone
Copy link
Author

The process of creating the config directory is not implemented on purpose. I don't want to break the application for people who already have QuickViewer installed. That's why the directory is only used if it already exists. Implementing directory creation and file movement is more than I feel comfortable doing blind.

Saving files under AppDir does not solve the problem of configuration files stored in the directory with executables in the portable version. There it also makes sense to separate the configs (writable) and the binaries (read-only).

@kanryu
Copy link
Owner

kanryu commented Nov 25, 2021

  • As a general rule, applications should not implement behavior that is not intended by the user. In this case, the behavior will change with and without the'config'directory.
  • When an application is installed under'Program Files', it is common behavior on Windows today that configuration files are saved under'AppDir' for individual users. It is unlikely that this specification remains a security issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants