e9c3ceb159
loader.interpret should not be used for executing loader commands from an untrusted source (e.g. environment vars) as it will allow execution of arbitrary Lua. Replace it with a call to the recently introduced cli_execute_unparsed, which parses it out as a loader command and then dispatches it as a loader command. This effectively filters out arbitrary Lua. |
||
---|---|---|
.. | ||
cli.lua | ||
color.lua | ||
config.lua | ||
core.lua | ||
core.lua.8 | ||
drawer.lua | ||
loader.lua | ||
Makefile | ||
menu.lua | ||
menu.lua.8 | ||
password.lua | ||
screen.lua |