From d8abb0f237aee44230643c40cb957556cd3c3cc4 Mon Sep 17 00:00:00 2001
From: David Walter Seikel <onefang@gmail.com>
Date: Fri, 11 Nov 2011 18:11:10 +0000
Subject: [PATCH] Sandbox the edje file setting. Patch up the argument getting
 for image setting. Still not sandboxing the image setting, that's a pain.

SVN revision: 65072
---
 legacy/edje/src/lib/edje_lua2.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/legacy/edje/src/lib/edje_lua2.c b/legacy/edje/src/lib/edje_lua2.c
index 72ef03763b..54f7c8d87f 100644
--- a/legacy/edje/src/lib/edje_lua2.c
+++ b/legacy/edje/src/lib/edje_lua2.c
@@ -2285,14 +2285,25 @@ _elua_image_image(lua_State *L)
 {
    Edje_Lua_Obj *obj = (Edje_Lua_Obj *)lua_touserdata(L, 1);
    Edje_Lua_Evas_Object *elo = (Edje_Lua_Evas_Object *)obj;
-   char *file = NULL, *key = NULL;
+   const char *file = NULL, *key = NULL;
+   int n;
 
    if (!obj) return 0;
    if (obj->meta != _elua_meta_evas) return 0;
 
-   if (_elua_2_str_get(L, 2, EINA_TRUE, "file", &file, "key", &key) > 0)
+   n = lua_gettop(L);
+
+   if (3 == n)
+      n = _elua_2_str_get(L, 2, EINA_TRUE, "file", &file, "key", &key);
+   else if (2 == n)
      {
-        // FIXME: ONLY allow access to the images in the current edje file.
+        file = obj->ed->file->path;
+        key = lua_tostring(L, 2);
+     }
+
+   if (1 < n)
+     {
+        // FIXME: Sandbox lua - Only allow access to images within the same file.
         evas_object_image_file_set(elo->evas_obj, file, key);
      }
    evas_object_image_file_get(elo->evas_obj, (const char **) &file, (const char **) &key);
@@ -2352,10 +2363,11 @@ static int _elua_edje_file(lua_State *L)
    if (!obj) return 0;
    if (obj->meta != _elua_meta_evas) return 0;
 
-   // FIXME: Only allow groups from the same file this edje came from.
    if (_elua_2_str_get(L, 2, EINA_TRUE, "file", &file, "group", &group) > 0)
      {
-        edje_object_file_set(elo->evas_obj, file, group);
+        // Sandbox lua - Only allow access to groups within the same file.
+        // By the simple expedient of completely ignoring what file was requested.
+        edje_object_file_set(elo->evas_obj, obj->ed->file->path, group);
      }
    edje_object_file_get(elo->evas_obj, (const char **) &file, (const char **) &group);
    _elua_str_ret(L, "file", file);